From 22f6d4ae92c6dcb17ef134b1c78b7ead973a4ee0 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 21 Dec 2022 08:53:03 -0700
Subject: [PATCH 1/6] Fantastic IIS Modules and Where to Find Them

---
 .../sc_exe_manipulating_windows_services.yml  |  4 +-
 ...ows_event_logging_disable_http_logging.yml | 85 ++++++++++++++++++
 .../windows_iis_components_add_new_module.yml | 86 +++++++++++++++++++
 ...nents_get_webglobalmodule_module_query.yml | 53 ++++++++++++
 ...s_iis_components_module_failed_to_load.yml | 58 +++++++++++++
 ...indows_iis_components_new_module_added.yml | 60 +++++++++++++
 ...ows_event_logging_disable_http_logging.yml | 64 ++++++++++++++
 ...l_iis_components_webglobalmodule_usage.yml | 63 ++++++++++++++
 .../windows_remote_access_software_hunt.yml   |  1 +
 lookups/remote_access_software.csv            |  4 +-
 macros/iis_get_webglobalmodule.yml            |  4 +
 macros/iis_operational_logs.yml               |  4 +
 stories/iis_components.yml                    | 27 ++++++
 stories/proxynotshell.yml                     |  1 +
 stories/proxyshell.yml                        |  1 +
 ...vent_logging_disable_http_logging.test.yml | 13 +++
 ...ows_iis_components_add_new_module.test.yml | 13 +++
 ..._get_webglobalmodule_module_query.test.yml | 13 +++
 ..._components_module_failed_to_load.test.yml | 13 +++
 ...s_iis_components_new_module_added.test.yml | 13 +++
 ...vent_logging_disable_http_logging.test.yml | 13 +++
 ..._components_webglobalmodule_usage.test.yml | 13 +++
 22 files changed, 604 insertions(+), 2 deletions(-)
 create mode 100644 detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml
 create mode 100644 detections/endpoint/windows_iis_components_add_new_module.yml
 create mode 100644 detections/endpoint/windows_iis_components_get_webglobalmodule_module_query.yml
 create mode 100644 detections/endpoint/windows_iis_components_module_failed_to_load.yml
 create mode 100644 detections/endpoint/windows_iis_components_new_module_added.yml
 create mode 100644 detections/endpoint/windows_powershell_disable_windows_event_logging_disable_http_logging.yml
 create mode 100644 detections/endpoint/windows_powershell_iis_components_webglobalmodule_usage.yml
 create mode 100644 macros/iis_get_webglobalmodule.yml
 create mode 100644 macros/iis_operational_logs.yml
 create mode 100644 stories/iis_components.yml
 create mode 100644 tests/endpoint/windows_disable_windows_event_logging_disable_http_logging.test.yml
 create mode 100644 tests/endpoint/windows_iis_components_add_new_module.test.yml
 create mode 100644 tests/endpoint/windows_iis_components_get_webglobalmodule_module_query.test.yml
 create mode 100644 tests/endpoint/windows_iis_components_module_failed_to_load.test.yml
 create mode 100644 tests/endpoint/windows_iis_components_new_module_added.test.yml
 create mode 100644 tests/endpoint/windows_powershell_disable_windows_event_logging_disable_http_logging.test.yml
 create mode 100644 tests/endpoint/windows_powershell_iis_components_webglobalmodule_usage.test.yml

diff --git a/detections/endpoint/sc_exe_manipulating_windows_services.yml b/detections/endpoint/sc_exe_manipulating_windows_services.yml
index fe86c4b9f8..62593b8ad1 100644
--- a/detections/endpoint/sc_exe_manipulating_windows_services.yml
+++ b/detections/endpoint/sc_exe_manipulating_windows_services.yml
@@ -20,7 +20,8 @@ how_to_implement: To successfully implement this search you need to be ingesting
 known_false_positives: Using sc.exe to manipulate Windows services is uncommon. However,
   there may be legitimate instances of this behavior. It is important to validate
   and investigate as appropriate.
-references: []
+references:
+  - https://www.secureworks.com/blog/drokbk-malware-uses-github-as-dead-drop-resolver
 tags:
   analytic_story:
   - Windows Service Abuse
@@ -30,6 +31,7 @@ tags:
   - Disabling Security Tools
   - NOBELIUM Group
   - Azorult
+  - Windows Drivers
   asset_type: Endpoint
   cis20:
   - CIS 3
diff --git a/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml b/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml
new file mode 100644
index 0000000000..202a12a4ab
--- /dev/null
+++ b/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml
@@ -0,0 +1,85 @@
+name: Windows Disable Windows Event Logging Disable HTTP Logging
+id: 23fb6787-255f-4d5b-9a66-9fd7504032b5
+version: 1
+date: '2022-12-21'
+author: Michael Haag, Splunk
+type: TTP
+datamodel: []
+description: The following analytic identifies AppCmd.exe being utilized to disable HTTP logging on IIS.
+  Adversaries may perform this action to disable logging and delete the logs so remove any trace or events on disk.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where  Processes.process_name=appcmd.exe 
+  Processes.process IN ("*set config*", "*httplogging*","*dontlog:true*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_disable_windows_event_logging_disable_http_logging_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives may be present only if scripts or Administrators are disabling logging. Filter as needed by parent process or other.
+references:
+  - https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework-1.pdf
+  - https://unit42.paloaltonetworks.com/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/
+  - https://www.secureworks.com/research/bronze-union
+  - https://strontic.github.io/xcyclopedia/library/appcmd.exe-055B2B09409F980BF9B5A3969D01E5B2.html
+tags:
+  analytic_story:
+  - IIS Components
+  - Windows Defense Evasion Tactics
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.004/disable_http_logging_windows-sysmon.log
+  impact: 80
+  kill_chain_phases:
+  - Actions on Objectives
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to disable IIS HTTP Logging.
+  mitre_attack_id:
+  - T1562.002
+  - T1562
+  - T1505
+  - T1505.004
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 64
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/windows_iis_components_add_new_module.yml b/detections/endpoint/windows_iis_components_add_new_module.yml
new file mode 100644
index 0000000000..3484d2c525
--- /dev/null
+++ b/detections/endpoint/windows_iis_components_add_new_module.yml
@@ -0,0 +1,86 @@
+name: Windows IIS Components Add New Module
+id: 38fe731c-1f13-43d4-b878-a5bbe44807e3
+version: 1
+date: '2022-12-19'
+author: Michael Haag, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic identifies the process AppCmd.exe installing a new module into IIS.
+  AppCmd is a utility to manage IIS web sites and App Pools.
+  An adversary may run this command to install a webshell or backdoor. This has been found to be used for credit card scraping, persistence, and further post-exploitation.
+  An administrator may run this to install new modules for a web site or during IIS updates.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where NOT (Processes.parent_process_name  IN ("msiexec.exe", "iissetup.exe")) Processes.process_name=appcmd.exe 
+  Processes.process IN ("*install *", "*module *") AND Processes.process="*image*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_iis_components_add_new_module_filter`'
+how_to_implement: Tune the analytic for your environment by filtering by known good modules or processes. Enable as TTP once the volume is low enough. To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives may be present until properly tuned. Filter as needed.
+references:
+  - https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/
+  - https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework-1.pdf
+  - https://unit42.paloaltonetworks.com/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/
+  - https://www.secureworks.com/research/bronze-union
+  - https://strontic.github.io/xcyclopedia/library/appcmd.exe-055B2B09409F980BF9B5A3969D01E5B2.html
+tags:
+  analytic_story:
+  - IIS Components
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.004/appcmd_install-windows-sysmon.log
+  impact: 80
+  kill_chain_phases:
+  - Installation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to install a new IIS module.
+  mitre_attack_id:
+  - T1505
+  - T1505.004
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 64
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/windows_iis_components_get_webglobalmodule_module_query.yml b/detections/endpoint/windows_iis_components_get_webglobalmodule_module_query.yml
new file mode 100644
index 0000000000..09f85563c7
--- /dev/null
+++ b/detections/endpoint/windows_iis_components_get_webglobalmodule_module_query.yml
@@ -0,0 +1,53 @@
+name: Windows IIS Components Get-WebGlobalModule Module Query
+id: 20db5f70-34b4-4e83-8926-fa26119de173
+version: 1
+date: '2022-12-20'
+author: Michael Haag, Splunk
+type: Hunting
+datamodel: []
+description: The following analytic requires the use of PowerShell inputs to run Get-WebGlobalModule to list out all the IIS Modules installed. The output is a list of Module names and the Image path of the DLL. 
+search: '`iis_get_webglobalmodule` | stats count min(_time) as firstTime max(_time) as lastTime by host name image | rename host as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_iis_components_get_webglobalmodule_module_query_filter`'
+how_to_implement: You must ingest the PwSh cmdlet Get-WebGlobalModule in order to utilize this analytic. Follow https://gist.github.com/MHaggis/64396dfd9fc3734e1d1901a8f2f07040
+known_false_positives: This analytic is meant to assist with hunting modules across a fleet of IIS servers. Filter and modify as needed.
+references:
+- https://docs.splunk.com/Documentation/Splunk/9.0.2/Data/MonitorWindowsdatawithPowerShellscripts
+- https://gist.github.com/MHaggis/64396dfd9fc3734e1d1901a8f2f07040
+tags:
+  analytic_story:
+  - IIS Components
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 10
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.004/pwsh_installediismodules.log
+  impact: 10
+  kill_chain_phases:
+  - Installation
+  message: IIS Modules have listed on $dest$.
+  mitre_attack_id:
+  - T1505.004
+  - T1505
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - host 
+  - name 
+  - image
+  risk_score: 1
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/windows_iis_components_module_failed_to_load.yml b/detections/endpoint/windows_iis_components_module_failed_to_load.yml
new file mode 100644
index 0000000000..c0de448530
--- /dev/null
+++ b/detections/endpoint/windows_iis_components_module_failed_to_load.yml
@@ -0,0 +1,58 @@
+name: Windows IIS Components Module Failed to Load
+id: 40c2ba5b-dd6a-496b-9e6e-c9524d0be167
+version: 1
+date: '2022-12-20'
+author: Michael Haag, Splunk
+type: Anomaly
+datamodel: []
+description: The following analytic utilizes EventCode 2282 which generates when a Module DLL could not be loaded due to a configuration problem. This typically occurs when a IIS module is installed but is failing to load. This typically results in thousands of events until the issue is resolved.
+  Review the module that is failing and determine if it is legitimate or not.
+search: '`wineventlog_application` EventCode=2282 | stats  count min(_time) as firstTime max(_time) as lastTime by  EventCode dest Name ModuleDll | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_iis_components_module_failed_to_load_filter`'
+how_to_implement: IIS must be installed and Application event logs must be collected in order to utilize this analytic.
+known_false_positives: False positives will be present until all module failures are resolved or reviewed.
+references:
+  - https://social.technet.microsoft.com/wiki/contents/articles/21757.event-id-2282-iis-worker-process-availability.aspx
+  - https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/
+  - https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework-1.pdf
+  - https://unit42.paloaltonetworks.com/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/
+  - https://www.secureworks.com/research/bronze-union
+  - https://strontic.github.io/xcyclopedia/library/appcmd.exe-055B2B09409F980BF9B5A3969D01E5B2.html
+tags:
+  analytic_story:
+  - IIS Components
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 50
+  context:
+  - Source:Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.004/2282_windows-application.log
+  impact: 50
+  kill_chain_phases:
+  - Installation
+  message: A new IIS Module has been loaded and should be reviewed on $dest$.
+  mitre_attack_id:
+  - T1505
+  - T1505.004
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - OpCode
+  - EventCode 
+  - ComputerName
+  - Message
+  risk_score: 25
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/windows_iis_components_new_module_added.yml b/detections/endpoint/windows_iis_components_new_module_added.yml
new file mode 100644
index 0000000000..416b33060e
--- /dev/null
+++ b/detections/endpoint/windows_iis_components_new_module_added.yml
@@ -0,0 +1,60 @@
+name: Windows IIS Components New Module Added
+id: 55f22929-cfd3-4388-ba5c-4d01fac7ee7e
+version: 1
+date: '2022-12-19'
+author: Michael Haag, Splunk
+type: TTP
+datamodel: []
+description: The following analytic uses the Windows Event log - Microsoft-IIS-Configuration/Operational - which must be enabled and logged on Windows IIS servers before it can be Splunked. The following analytic identifies newly installed IIS modules.
+  Per Microsoft, IIS modules are not commonly added to a production IIS server, so alerting on this event ID should be enabled.IIS modules can be installed at a global level or at a site level. In detecting malicious IIS modules, it is important to check both the global and site level for unauthorized modules. Regular monitoring of these locations for such modules and comparing against a known good list can help detect and identify malicious IIS modules.
+search: '`iis_operational_logs` EventCode=29
+  | stats  count min(_time) as firstTime max(_time) as lastTime by OpCode EventCode ComputerName Message | rename ComputerName AS dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_iis_components_new_module_added_filter`'
+how_to_implement: You must enabled the IIS Configuration Operational log before Splunking. Once Splunked, the data may be queried against following the provided query.
+known_false_positives: False positives may be present when updates or an administrator adds a new module to IIS. Monitor and filter as needed.
+references:
+  - https://gist.github.com/MHaggis/64396dfd9fc3734e1d1901a8f2f07040
+  - https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/
+  - https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework-1.pdf
+  - https://unit42.paloaltonetworks.com/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/
+  - https://www.secureworks.com/research/bronze-union
+  - https://strontic.github.io/xcyclopedia/library/appcmd.exe-055B2B09409F980BF9B5A3969D01E5B2.html
+tags:
+  analytic_story:
+  - IIS Components
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.004/IIS-Configuration-Operational.log
+  impact: 60
+  kill_chain_phases:
+  - Installation
+  message: A new IIS Module has been loaded and should be reviewed on $dest$.
+  mitre_attack_id:
+  - T1505
+  - T1505.004
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - OpCode
+  - EventCode 
+  - ComputerName
+  - Message
+  risk_score: 48
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/windows_powershell_disable_windows_event_logging_disable_http_logging.yml b/detections/endpoint/windows_powershell_disable_windows_event_logging_disable_http_logging.yml
new file mode 100644
index 0000000000..70a1f44d65
--- /dev/null
+++ b/detections/endpoint/windows_powershell_disable_windows_event_logging_disable_http_logging.yml
@@ -0,0 +1,64 @@
+name: Windows PowerShell Disable Windows Event Logging Disable HTTP Logging
+id: 27958de0-2857-43ca-9d4c-b255cf59dcab
+version: 1
+date: '2022-12-21'
+author: Michael Haag, Splunk
+type: TTP
+datamodel: []
+description: The following analtyic identifies the use of get-WebConfigurationProperty and Set-ItemProperty attempting to disable HTTP logging on windows via PowerShell. 
+  Adversaries may perform this action to disable HTTP logging to cover tracks and delete logs on disk.
+search: '`powershell` EventCode=4104 ScriptBlockText IN("*get-WebConfigurationProperty*","*Set-ItemProperty*") AND ScriptBlockText IN ("*httpLogging*","*Logfile.enabled*") AND ScriptBlockText IN ("*dontLog*", "*false*")   | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `windows_powershell_disable_windows_event_logging_disable_http_logging_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: It is possible administrators or scripts may run these commands, filtering may be required.
+references:
+  - https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/
+  - https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework-1.pdf
+  - https://unit42.paloaltonetworks.com/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/
+  - https://www.secureworks.com/research/bronze-union
+tags:
+  analytic_story:
+  - IIS Components
+  - Windows Defense Evasion Tactics
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.004/4104_disable_http_logging_windows-powershell.log
+  impact: 80
+  kill_chain_phases:
+  - Actions on Objectives
+  message: A PowerShell Cmdlet related to disable or modifying a IIS HTTP logging has occurred on $Computer$.
+  mitre_attack_id:
+  - T1562
+  - T1562.002
+  - T1505
+  - T1505.004
+  nist:
+  - DE.CM
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - ScriptBlockText
+  - Computer
+  - EventCode
+  risk_score: 64
+  security_domain: endpoint
diff --git a/detections/endpoint/windows_powershell_iis_components_webglobalmodule_usage.yml b/detections/endpoint/windows_powershell_iis_components_webglobalmodule_usage.yml
new file mode 100644
index 0000000000..435c7ff1af
--- /dev/null
+++ b/detections/endpoint/windows_powershell_iis_components_webglobalmodule_usage.yml
@@ -0,0 +1,63 @@
+name: Windows PowerShell IIS Components WebGlobalModule Usage
+id: 33fc9f6f-0ce7-4696-924e-a69ec61a3d57
+version: 1
+date: '2022-12-21'
+author: Michael Haag, Splunk
+type: Anomaly
+datamodel: []
+description: The following analytic identifies the usage of PowerShell Cmdlets - New-WebGlobalModule, Enable-WebGlobalModule and Set-WebGlobalModule being utilized to create (new), enable (start) or modify a current IIS Module.
+  These commands are equivalent to AppCmd.exe parameters.
+  Adversaries may utilize these cmdlets as they are lesser known and perform the same activity as AppCmd. 
+search: '`powershell` EventCode=4104 ScriptBlockText IN("*New-WebGlobalModule*","*Enable-WebGlobalModule*","*Set-WebGlobalModule*")
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`  | `windows_powershell_iis_components_webglobalmodule_usage_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: It is possible administrators or scripts may run these commands, filtering may be required.
+references:
+  - https://learn.microsoft.com/en-us/powershell/module/webadministration/new-webglobalmodule?view=windowsserver2022-ps
+  - https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/
+  - https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework-1.pdf
+  - https://unit42.paloaltonetworks.com/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/
+  - https://www.secureworks.com/research/bronze-union
+tags:
+  analytic_story:
+  - IIS Components
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.004/4104_windows-powershell.log
+  impact: 80
+  kill_chain_phases:
+  - Installation
+  message: A PowerShell Cmdlet related to enabling, creating or modifying a IIS module has occurred on $Computer$.
+  mitre_attack_id:
+  - T1505
+  - T1505.004
+  nist:
+  - DE.CM
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - ScriptBlockText
+  - Computer
+  - EventCode
+  risk_score: 64
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/windows_remote_access_software_hunt.yml b/detections/endpoint/windows_remote_access_software_hunt.yml
index c7bb7477bf..6a9cdced9e 100644
--- a/detections/endpoint/windows_remote_access_software_hunt.yml
+++ b/detections/endpoint/windows_remote_access_software_hunt.yml
@@ -20,6 +20,7 @@ known_false_positives: False positives will be found. Filter as needed and creat
 references:
   - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
   - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1219/T1219.md
+  - https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/
 tags:
   analytic_story:
   - Insider Threat
diff --git a/lookups/remote_access_software.csv b/lookups/remote_access_software.csv
index 8a643f7e47..e6c9d07ac5 100644
--- a/lookups/remote_access_software.csv
+++ b/lookups/remote_access_software.csv
@@ -49,4 +49,6 @@ winvncsc.exe, VNC, TRUE
 winwvc.exe, VNC, TRUE
 Zaservice.exe, Zoho Assist, TRUE
 Zohours.exe, Zoho Assist, TRUE
-ZohoMeeting.exe, Zoho Assist, TRUE
\ No newline at end of file
+ZohoMeeting.exe, Zoho Assist, TRUE
+meshagent.exe, MeshAgent, TRUE
+tacticalrmm.exe, Tactical RMM, TRUE
\ No newline at end of file
diff --git a/macros/iis_get_webglobalmodule.yml b/macros/iis_get_webglobalmodule.yml
new file mode 100644
index 0000000000..110e57a12d
--- /dev/null
+++ b/macros/iis_get_webglobalmodule.yml
@@ -0,0 +1,4 @@
+definition: sourcetype="Pwsh:InstalledIISModules"
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: iis_get_webglobalmodule
\ No newline at end of file
diff --git a/macros/iis_operational_logs.yml b/macros/iis_operational_logs.yml
new file mode 100644
index 0000000000..b2de785850
--- /dev/null
+++ b/macros/iis_operational_logs.yml
@@ -0,0 +1,4 @@
+definition: sourcetype="IIS:Configuration:Operational"
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: iis_operational_logs
\ No newline at end of file
diff --git a/stories/iis_components.yml b/stories/iis_components.yml
new file mode 100644
index 0000000000..f17f62b722
--- /dev/null
+++ b/stories/iis_components.yml
@@ -0,0 +1,27 @@
+name: IIS Components
+id: 0fbde550-8252-43ab-a26a-03976f55b58b
+version: 1
+date: '2022-12-19'
+author: Michael Haag, Splunk
+description: Adversaries may install malicious components that run on Internet Information Services (IIS) web servers to establish persistence.
+narrative: IIS provides several mechanisms to extend the functionality of the web servers. For example, Internet Server Application Programming Interface (ISAPI) extensions and filters can be installed to examine and/or modify incoming and outgoing IIS web requests. Extensions and filters are deployed as DLL files that export three functions - Get{Extension/Filter}Version, Http{Extension/Filter}Proc, and (optionally) Terminate{Extension/Filter}. IIS modules may also be installed to extend IIS web servers.
+
+  Adversaries may install malicious ISAPI extensions and filters to observe and/or modify traffic, execute commands on compromised machines, or proxy command and control traffic. ISAPI extensions and filters may have access to all IIS web requests and responses. For example, an adversary may abuse these mechanisms to modify HTTP responses in order to distribute malicious commands/content to previously comprised hosts.
+
+  Adversaries may also install malicious IIS modules to observe and/or modify traffic. IIS 7.0 introduced modules that provide the same unrestricted access to HTTP requests and responses as ISAPI extensions and filters. IIS modules can be written as a DLL that exports RegisterModule, or as a .NET application that interfaces with ASP.NET APIs to access IIS HTTP requests. (reference MITRE)
+references:
+  - https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/
+  - https://attack.mitre.org/techniques/T1505/004/
+  - https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework-1.pdf
+  - https://unit42.paloaltonetworks.com/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/
+  - https://www.secureworks.com/research/bronze-union
+  - https://strontic.github.io/xcyclopedia/library/appcmd.exe-055B2B09409F980BF9B5A3969D01E5B2.html
+tags:
+  analytic_story: IIS Components
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection
diff --git a/stories/proxynotshell.yml b/stories/proxynotshell.yml
index b2b7439e34..61f1095523 100644
--- a/stories/proxynotshell.yml
+++ b/stories/proxynotshell.yml
@@ -11,6 +11,7 @@ references:
   - https://twitter.com/cglyer/status/1575793769814728705?s=20&t=67gq9xCWuyPm1VEm8ydfyA
   - https://www.gteltsc.vn/blog/warning-new-attack-campaign-utilized-a-new-0day-rce-vulnerability-on-microsoft-exchange-server-12715.html
   - https://research.splunk.com/stories/proxyshell/
+  - https://www.inversecos.com/2022/07/hunting-for-apt-abuse-of-exchange.html
 tags:
   analytic_story: ProxyNotShell
   category:
diff --git a/stories/proxyshell.yml b/stories/proxyshell.yml
index facd8dc41a..57ba733d78 100644
--- a/stories/proxyshell.yml
+++ b/stories/proxyshell.yml
@@ -22,6 +22,7 @@ references:
 - https://www.youtube.com/watch?v=FC6iHw258RI
 - https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit#what-should-you-do
 - https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-ProxyLogon-Is-Just-The-Tip-Of-The-Iceberg-A-New-Attack-Surface-On-Microsoft-Exchange-Server.pdf
+- https://www.inversecos.com/2022/07/hunting-for-apt-abuse-of-exchange.html
 tags:
   analytic_story: ProxyShell
   category:
diff --git a/tests/endpoint/windows_disable_windows_event_logging_disable_http_logging.test.yml b/tests/endpoint/windows_disable_windows_event_logging_disable_http_logging.test.yml
new file mode 100644
index 0000000000..356f769762
--- /dev/null
+++ b/tests/endpoint/windows_disable_windows_event_logging_disable_http_logging.test.yml
@@ -0,0 +1,13 @@
+name: Windows Disable Windows Event Logging Disable HTTP Logging Unit Test
+tests:
+- name: Windows Disable Windows Event Logging Disable HTTP Logging
+  file: endpoint/windows_disable_windows_event_logging_disable_http_logging.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: disable_http_logging_windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.004/disable_http_logging_windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog 
+    update_timestamp: true
diff --git a/tests/endpoint/windows_iis_components_add_new_module.test.yml b/tests/endpoint/windows_iis_components_add_new_module.test.yml
new file mode 100644
index 0000000000..86fc7aeed9
--- /dev/null
+++ b/tests/endpoint/windows_iis_components_add_new_module.test.yml
@@ -0,0 +1,13 @@
+name: Windows IIS Components Add New Module Unit Test
+tests:
+- name: Windows IIS Components Add New Module
+  file: endpoint/windows_iis_components_add_new_module.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: appcmd_install-windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.004/appcmd_install-windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true
diff --git a/tests/endpoint/windows_iis_components_get_webglobalmodule_module_query.test.yml b/tests/endpoint/windows_iis_components_get_webglobalmodule_module_query.test.yml
new file mode 100644
index 0000000000..7a2a591f12
--- /dev/null
+++ b/tests/endpoint/windows_iis_components_get_webglobalmodule_module_query.test.yml
@@ -0,0 +1,13 @@
+name: Windows IIS Components Get-WebGlobalModule Module Query Unit Test
+tests:
+- name: Windows IIS Components Get-WebGlobalModule Module Query
+  file: endpoint/windows_iis_components_get_webglobalmodule_module_query.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: UPDATE
+    data: UPDATE
+    source: UPDATE
+    sourcetype: UPDATE
+    update_timestamp: true
diff --git a/tests/endpoint/windows_iis_components_module_failed_to_load.test.yml b/tests/endpoint/windows_iis_components_module_failed_to_load.test.yml
new file mode 100644
index 0000000000..96450dbb77
--- /dev/null
+++ b/tests/endpoint/windows_iis_components_module_failed_to_load.test.yml
@@ -0,0 +1,13 @@
+name: Windows IIS Components Module Failed to Load Unit Test
+tests:
+- name: Windows IIS Components Module Failed to Load
+  file: endpoint/windows_iis_components_module_failed_to_load.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: 2282_windows-application.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.004/2282_windows-application.log
+    source: XmlWinEventLog:Application
+    sourcetype: XmlWinEventLog
+    update_timestamp: true
\ No newline at end of file
diff --git a/tests/endpoint/windows_iis_components_new_module_added.test.yml b/tests/endpoint/windows_iis_components_new_module_added.test.yml
new file mode 100644
index 0000000000..75afdf5c8c
--- /dev/null
+++ b/tests/endpoint/windows_iis_components_new_module_added.test.yml
@@ -0,0 +1,13 @@
+name: Windows IIS Components New Module Added Unit Test
+tests:
+- name: Windows IIS Components New Module Added
+  file: endpoint/windows_iis_components_new_module_added.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: IIS-Configuration-Operational.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.004/IIS-Configuration-Operational.log
+    source: IIS:Configuration:Operational
+    sourcetype: IIS:Configuration:Operational
+    update_timestamp: true
diff --git a/tests/endpoint/windows_powershell_disable_windows_event_logging_disable_http_logging.test.yml b/tests/endpoint/windows_powershell_disable_windows_event_logging_disable_http_logging.test.yml
new file mode 100644
index 0000000000..d4981b11de
--- /dev/null
+++ b/tests/endpoint/windows_powershell_disable_windows_event_logging_disable_http_logging.test.yml
@@ -0,0 +1,13 @@
+name: Windows PowerShell Disable Windows Event Logging Disable HTTP Logging Unit Test
+tests:
+- name: Windows PowerShell Disable Windows Event Logging Disable HTTP Logging
+  file: endpoint/windows_powershell_disable_windows_event_logging_disable_http_logging.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: 4104_disable_http_logging_windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.004/4104_disable_http_logging_windows-powershell.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true
diff --git a/tests/endpoint/windows_powershell_iis_components_webglobalmodule_usage.test.yml b/tests/endpoint/windows_powershell_iis_components_webglobalmodule_usage.test.yml
new file mode 100644
index 0000000000..c3871ed15d
--- /dev/null
+++ b/tests/endpoint/windows_powershell_iis_components_webglobalmodule_usage.test.yml
@@ -0,0 +1,13 @@
+name: Windows PowerShell IIS Components WebGlobalModule Usage Unit Test
+tests:
+- name: Windows PowerShell IIS Components WebGlobalModule Usage
+  file: endpoint/windows_powershell_iis_components_webglobalmodule_usage.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: 4104_windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.004/4104_windows-powershell.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

From 6774b91d1cf870f04ed9eb638bd3a1d865a1578b Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 21 Dec 2022 08:58:59 -0700
Subject: [PATCH 2/6] fixes

---
 ...s_disable_windows_event_logging_disable_http_logging.yml | 2 +-
 .../endpoint/windows_iis_components_add_new_module.yml      | 2 +-
 ...ging.yml => windows_powershell_disable_http_logging.yml} | 4 ++--
 ...yml => windows_powershell_disable_http_logging.test.yml} | 6 +++---
 4 files changed, 7 insertions(+), 7 deletions(-)
 rename detections/endpoint/{windows_powershell_disable_windows_event_logging_disable_http_logging.yml => windows_powershell_disable_http_logging.yml} (94%)
 rename tests/endpoint/{windows_powershell_disable_windows_event_logging_disable_http_logging.test.yml => windows_powershell_disable_http_logging.test.yml} (64%)

diff --git a/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml b/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml
index 202a12a4ab..60e2065125 100644
--- a/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml
+++ b/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml
@@ -57,7 +57,7 @@ tags:
     role:
     - Victim
   - name: parent_process_name
-    type: Parent Process
+    type: Process
     role:
     - Parent Process
   - name: process_name
diff --git a/detections/endpoint/windows_iis_components_add_new_module.yml b/detections/endpoint/windows_iis_components_add_new_module.yml
index 3484d2c525..e32778ef11 100644
--- a/detections/endpoint/windows_iis_components_add_new_module.yml
+++ b/detections/endpoint/windows_iis_components_add_new_module.yml
@@ -58,7 +58,7 @@ tags:
     role:
     - Victim
   - name: parent_process_name
-    type: Parent Process
+    type: Process
     role:
     - Parent Process
   - name: process_name
diff --git a/detections/endpoint/windows_powershell_disable_windows_event_logging_disable_http_logging.yml b/detections/endpoint/windows_powershell_disable_http_logging.yml
similarity index 94%
rename from detections/endpoint/windows_powershell_disable_windows_event_logging_disable_http_logging.yml
rename to detections/endpoint/windows_powershell_disable_http_logging.yml
index 70a1f44d65..c0ff6c538c 100644
--- a/detections/endpoint/windows_powershell_disable_windows_event_logging_disable_http_logging.yml
+++ b/detections/endpoint/windows_powershell_disable_http_logging.yml
@@ -1,4 +1,4 @@
-name: Windows PowerShell Disable Windows Event Logging Disable HTTP Logging
+name: Windows PowerShell Disable HTTP Logging
 id: 27958de0-2857-43ca-9d4c-b255cf59dcab
 version: 1
 date: '2022-12-21'
@@ -10,7 +10,7 @@ description: The following analtyic identifies the use of get-WebConfigurationPr
 search: '`powershell` EventCode=4104 ScriptBlockText IN("*get-WebConfigurationProperty*","*Set-ItemProperty*") AND ScriptBlockText IN ("*httpLogging*","*Logfile.enabled*") AND ScriptBlockText IN ("*dontLog*", "*false*")   | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id 
   | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)`
-  | `windows_powershell_disable_windows_event_logging_disable_http_logging_filter`'
+  | `windows_powershell_disable_http_logging_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
   https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
diff --git a/tests/endpoint/windows_powershell_disable_windows_event_logging_disable_http_logging.test.yml b/tests/endpoint/windows_powershell_disable_http_logging.test.yml
similarity index 64%
rename from tests/endpoint/windows_powershell_disable_windows_event_logging_disable_http_logging.test.yml
rename to tests/endpoint/windows_powershell_disable_http_logging.test.yml
index d4981b11de..917b18c3a0 100644
--- a/tests/endpoint/windows_powershell_disable_windows_event_logging_disable_http_logging.test.yml
+++ b/tests/endpoint/windows_powershell_disable_http_logging.test.yml
@@ -1,7 +1,7 @@
-name: Windows PowerShell Disable Windows Event Logging Disable HTTP Logging Unit Test
+name: Windows PowerShell Disable HTTP Logging Unit Test
 tests:
-- name: Windows PowerShell Disable Windows Event Logging Disable HTTP Logging
-  file: endpoint/windows_powershell_disable_windows_event_logging_disable_http_logging.yml
+- name: Windows PowerShell Disable HTTP Logging
+  file: endpoint/windows_powershell_disable_http_logging.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: -24h
   latest_time: now

From 69c469639c4ec6fb29316ddfc613444f5720ed09 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 21 Dec 2022 09:18:23 -0700
Subject: [PATCH 3/6] Fixes

---
 ...ws_iis_components_get_webglobalmodule_module_query.yml | 2 +-
 ...s_components_get_webglobalmodule_module_query.test.yml | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/detections/endpoint/windows_iis_components_get_webglobalmodule_module_query.yml b/detections/endpoint/windows_iis_components_get_webglobalmodule_module_query.yml
index 09f85563c7..7f6d5310c3 100644
--- a/detections/endpoint/windows_iis_components_get_webglobalmodule_module_query.yml
+++ b/detections/endpoint/windows_iis_components_get_webglobalmodule_module_query.yml
@@ -29,7 +29,7 @@ tags:
   impact: 10
   kill_chain_phases:
   - Installation
-  message: IIS Modules have listed on $dest$.
+  message: IIS Modules have been listed on $dest$.
   mitre_attack_id:
   - T1505.004
   - T1505
diff --git a/tests/endpoint/windows_iis_components_get_webglobalmodule_module_query.test.yml b/tests/endpoint/windows_iis_components_get_webglobalmodule_module_query.test.yml
index 7a2a591f12..43f6ad494f 100644
--- a/tests/endpoint/windows_iis_components_get_webglobalmodule_module_query.test.yml
+++ b/tests/endpoint/windows_iis_components_get_webglobalmodule_module_query.test.yml
@@ -6,8 +6,8 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: UPDATE
-    data: UPDATE
-    source: UPDATE
-    sourcetype: UPDATE
+  - file_name: pwsh_installediismodules.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.004/pwsh_installediismodules.log
+    source: powershell://AppCmdModules
+    sourcetype: Pwsh:InstalledIISModules
     update_timestamp: true

From 5e5a98030a6059b7eef82d5547a0708e69b5efd5 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Sat, 31 Dec 2022 08:10:32 -0700
Subject: [PATCH 4/6] Update
 windows_disable_windows_event_logging_disable_http_logging.yml

---
 ...ows_disable_windows_event_logging_disable_http_logging.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml b/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml
index 60e2065125..07e22a4f3c 100644
--- a/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml
+++ b/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml
@@ -8,7 +8,7 @@ datamodel: []
 description: The following analytic identifies AppCmd.exe being utilized to disable HTTP logging on IIS.
   Adversaries may perform this action to disable logging and delete the logs so remove any trace or events on disk.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where  Processes.process_name=appcmd.exe 
+  as lastTime from datamodel=Endpoint.Processes where NOT (Processes.parent_process_name  IN ("msiexec.exe", "iissetup.exe")) Processes.process_name=appcmd.exe 
   Processes.process IN ("*set config*", "*httplogging*","*dontlog:true*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
   Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` 
@@ -82,4 +82,4 @@ tags:
   - Processes.process_path
   - Processes.parent_process_id
   risk_score: 64
-  security_domain: endpoint
\ No newline at end of file
+  security_domain: endpoint

From 8a6bfc445870c2e41ce14cc413a17c34127bf30e Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 3 Jan 2023 10:07:28 -0700
Subject: [PATCH 5/6] Atomic Reference

---
 detections/endpoint/windows_iis_components_add_new_module.yml    | 1 +
 .../windows_iis_components_get_webglobalmodule_module_query.yml  | 1 +
 .../endpoint/windows_iis_components_module_failed_to_load.yml    | 1 +
 detections/endpoint/windows_iis_components_new_module_added.yml  | 1 +
 .../windows_powershell_iis_components_webglobalmodule_usage.yml  | 1 +
 5 files changed, 5 insertions(+)

diff --git a/detections/endpoint/windows_iis_components_add_new_module.yml b/detections/endpoint/windows_iis_components_add_new_module.yml
index e32778ef11..8690e26e12 100644
--- a/detections/endpoint/windows_iis_components_add_new_module.yml
+++ b/detections/endpoint/windows_iis_components_add_new_module.yml
@@ -24,6 +24,7 @@ references:
   - https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework-1.pdf
   - https://unit42.paloaltonetworks.com/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/
   - https://www.secureworks.com/research/bronze-union
+  - https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1505.004
   - https://strontic.github.io/xcyclopedia/library/appcmd.exe-055B2B09409F980BF9B5A3969D01E5B2.html
 tags:
   analytic_story:
diff --git a/detections/endpoint/windows_iis_components_get_webglobalmodule_module_query.yml b/detections/endpoint/windows_iis_components_get_webglobalmodule_module_query.yml
index 7f6d5310c3..a7d92f18a8 100644
--- a/detections/endpoint/windows_iis_components_get_webglobalmodule_module_query.yml
+++ b/detections/endpoint/windows_iis_components_get_webglobalmodule_module_query.yml
@@ -12,6 +12,7 @@ known_false_positives: This analytic is meant to assist with hunting modules acr
 references:
 - https://docs.splunk.com/Documentation/Splunk/9.0.2/Data/MonitorWindowsdatawithPowerShellscripts
 - https://gist.github.com/MHaggis/64396dfd9fc3734e1d1901a8f2f07040
+- https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1505.004
 tags:
   analytic_story:
   - IIS Components
diff --git a/detections/endpoint/windows_iis_components_module_failed_to_load.yml b/detections/endpoint/windows_iis_components_module_failed_to_load.yml
index c0de448530..25cfbc6f1b 100644
--- a/detections/endpoint/windows_iis_components_module_failed_to_load.yml
+++ b/detections/endpoint/windows_iis_components_module_failed_to_load.yml
@@ -16,6 +16,7 @@ references:
   - https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework-1.pdf
   - https://unit42.paloaltonetworks.com/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/
   - https://www.secureworks.com/research/bronze-union
+  - https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1505.004
   - https://strontic.github.io/xcyclopedia/library/appcmd.exe-055B2B09409F980BF9B5A3969D01E5B2.html
 tags:
   analytic_story:
diff --git a/detections/endpoint/windows_iis_components_new_module_added.yml b/detections/endpoint/windows_iis_components_new_module_added.yml
index 416b33060e..0d4948ccab 100644
--- a/detections/endpoint/windows_iis_components_new_module_added.yml
+++ b/detections/endpoint/windows_iis_components_new_module_added.yml
@@ -17,6 +17,7 @@ references:
   - https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework-1.pdf
   - https://unit42.paloaltonetworks.com/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/
   - https://www.secureworks.com/research/bronze-union
+  - https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1505.004
   - https://strontic.github.io/xcyclopedia/library/appcmd.exe-055B2B09409F980BF9B5A3969D01E5B2.html
 tags:
   analytic_story:
diff --git a/detections/endpoint/windows_powershell_iis_components_webglobalmodule_usage.yml b/detections/endpoint/windows_powershell_iis_components_webglobalmodule_usage.yml
index 435c7ff1af..2094336079 100644
--- a/detections/endpoint/windows_powershell_iis_components_webglobalmodule_usage.yml
+++ b/detections/endpoint/windows_powershell_iis_components_webglobalmodule_usage.yml
@@ -22,6 +22,7 @@ references:
   - https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework-1.pdf
   - https://unit42.paloaltonetworks.com/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/
   - https://www.secureworks.com/research/bronze-union
+  - https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1505.004
 tags:
   analytic_story:
   - IIS Components

From ab2fa3b58db5f243443a3b69b853bc0ba3fa959d Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 10 Jan 2023 14:14:19 -0700
Subject: [PATCH 6/6] howto

---
 detections/endpoint/windows_iis_components_new_module_added.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_iis_components_new_module_added.yml b/detections/endpoint/windows_iis_components_new_module_added.yml
index 0d4948ccab..fcebde25fb 100644
--- a/detections/endpoint/windows_iis_components_new_module_added.yml
+++ b/detections/endpoint/windows_iis_components_new_module_added.yml
@@ -9,7 +9,7 @@ description: The following analytic uses the Windows Event log - Microsoft-IIS-C
   Per Microsoft, IIS modules are not commonly added to a production IIS server, so alerting on this event ID should be enabled.IIS modules can be installed at a global level or at a site level. In detecting malicious IIS modules, it is important to check both the global and site level for unauthorized modules. Regular monitoring of these locations for such modules and comparing against a known good list can help detect and identify malicious IIS modules.
 search: '`iis_operational_logs` EventCode=29
   | stats  count min(_time) as firstTime max(_time) as lastTime by OpCode EventCode ComputerName Message | rename ComputerName AS dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_iis_components_new_module_added_filter`'
-how_to_implement: You must enabled the IIS Configuration Operational log before Splunking. Once Splunked, the data may be queried against following the provided query.
+how_to_implement: You must enabled the IIS Configuration Operational log before ingesting in Splunk. Setup and inputs may be found here https://gist.github.com/MHaggis/64396dfd9fc3734e1d1901a8f2f07040.
 known_false_positives: False positives may be present when updates or an administrator adds a new module to IIS. Monitor and filter as needed.
 references:
   - https://gist.github.com/MHaggis/64396dfd9fc3734e1d1901a8f2f07040