name: Windows PowerShell Disable HTTP Logging
id: 27958de0-2857-43ca-9d4c-b255cf59dcab
version: 1
date: '2022-12-21'
author: Michael Haag, Splunk
type: TTP
datamodel: []
description: The following analtyic identifies the use of get-WebConfigurationProperty and Set-ItemProperty attempting to disable HTTP logging on windows via PowerShell. 
  Adversaries may perform this action to disable HTTP logging to cover tracks and delete logs on disk.
search: '`powershell` EventCode=4104 ScriptBlockText IN("*get-WebConfigurationProperty*","*Set-ItemProperty*") AND ScriptBlockText IN ("*httpLogging*","*Logfile.enabled*") AND ScriptBlockText IN ("*dontLog*", "*false*")   | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id 
  | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)`
  | `windows_powershell_disable_http_logging_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
  PowerShell Script Block Logging on some or all endpoints. Additional setup here
  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
known_false_positives: It is possible administrators or scripts may run these commands, filtering may be required.
references:
  - https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/
  - https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework-1.pdf
  - https://unit42.paloaltonetworks.com/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/
  - https://www.secureworks.com/research/bronze-union
tags:
  analytic_story:
  - IIS Components
  - Windows Defense Evasion Tactics
  asset_type: Endpoint
  cis20:
  - CIS 3
  - CIS 5
  - CIS 16
  confidence: 80
  context:
  - Source:Endpoint
  - Stage:Defense Evasion
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.004/4104_disable_http_logging_windows-powershell.log
  impact: 80
  kill_chain_phases:
  - Actions on Objectives
  message: A PowerShell Cmdlet related to disable or modifying a IIS HTTP logging has occurred on $Computer$.
  mitre_attack_id:
  - T1562
  - T1562.002
  - T1505
  - T1505.004
  nist:
  - DE.CM
  observable:
  - name: Computer
    type: Hostname
    role:
    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - ScriptBlockText
  - Computer
  - EventCode
  risk_score: 64
  security_domain: endpoint