T1505.004 — IIS Components

T1505.004 Server Software Component: IIS Components

title: "T1505.004 Server Software Component: IIS Components"
id: c35d7984-7adb-434d-9434-c92b65ea6b64
description: 'Detection Strategy for T1505.004 - Malicious IIS Components via non-standard DLL loads into w3wp.exe or new DLL writes under inetsrv. (Data Component: Module Load / File Creation; baseline tier: windows-eventid.) Tune using: TimeWindow, UserContext, WatchedPaths, DLLNameEntropyThreshold, ParentProcessName.'
references:
  - https://attack.mitre.org/techniques/T1505/004
author: Shahrukh Khan
date: 2026-01-14
license: MIT
tags:
  - attack.persistence
  - attack.t1505.004

logsource:
  product: windows
  service: sysmon

detection:
  selection_isapi_dll_load:
    EventID: 7
    Image|endswith: '\w3wp.exe'
    ImageLoaded|endswith: '.dll'
  filter_system_dirs:
    ImageLoaded|contains:
      - '\Windows\System32\'
      - '\Windows\SysWOW64\'
  selection_module_file_write:
    EventID: 11
    TargetFilename|contains: '\inetsrv\'
    TargetFilename|endswith: '.dll'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: ((selection_isapi_dll_load and not filter_system_dirs) or selection_module_file_write) and not filter_system_account

falsepositives:
  - Legitimate IIS module installs/updates by administrators.

level: medium