IIS-Sassins
Internet Information Services (IIS) is a commonly used web server produced by Microsoft to assist organizations of all sizes to host content publicly or internally including on premise SharePoint or Exchange. IIS modules are like building blocks, modules may be added to the server in order to provide the desired functionality for applications. It is typically not very common on static IIS instances, like Exchange or SharePoint on premise. How are modules installed? Simply by using one of three methods on Windows - The IIS interface, AppCmd.exe and PowerShell New-WebGlobalModule. How are adversaries using IIS modules? Microsoft published two blogs in 2022 (July and December) detailing first how adversaries will persist with IIS modules and later showcasing how to detect them. In parallel, CrowdStrike has been tracking a campaign since 2021 dubbed IceApple that has evolved over the years by installing multiple modules to perform different post-exploitation functions.
IIS Modules
Content
- GACUTIL (gacutil /i)
- AppCmd (%windir%\system32\inetsrv\appcmd.exe install module /name:namehere /image:pathtodll.dll)
- Pwsh Cmdlets (new-webglobalmodule)
- Atomic
- Splunk Content
- References
- https://www.microsoft.com/en-us/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/
- https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/
- https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework-1.pdf
- https://securelist.com/the-sessionmanager-iis-backdoor/106868/
- https://www.malwarebytes.com/blog/news/2022/07/iis-extensions-are-on-the-rise-as-backdoors-to-servers
- Modules to Test with
- IIS
- Patch web apps
- Move web servers into a DMZ and restrict internal access.
- Disable egress to only what is needed by servers
- Use application control to dismiss any new binaries on disk
- Use a web application firewall
- Move left: prevent the activity first.
- Inventory Modules
In the Microsoft blog it is recommended to enable advanced IIS logging to hunt for web shells. The Microsoft-IIS-Configuration/Operational log provides details on new modules being added by site/app pool.
- Lists additional logs available for IIS:
wevtutil el | findstr -i IIS - Configuration for the selected log:
wevtutil gl Microsoft-IIS-Configuration/Operational - Enable the selected log:
wevtutil sl /e:true Microsoft-IIS-Configuration/Operational
[WinEventLog://Microsoft-IIS-Configuration/Operational]
index=win
sourcetype=IIS:Configuration:Operational
disabled = false
###
# Modify cron schedule as you like. Default is once daily.
# Modify index as needed.
# We recommend this method over the other options provided.
###
[powershell://IISModules]
script = Get-WebGlobalModule
schedule = */1 * * * *
#schedule = 0 0 * * *
sourcetype = Pwsh:InstalledIISModules
index=iis
https://gist.github.com/MHaggis/64396dfd9fc3734e1d1901a8f2f07040
Once logged, in Splunk it looks like this:
First is a native module. A native module is typically going to be a DLL deployed to the server and loaded up via IIS Administration Tool, PowerShell or AppCmd. Per Microsoft, all three of these installation methods result in the module entry being added to the IIS configuration section in %windir%\system32\inetsrv\config\applicationhost.config
managed modules. Per Microsoft, a managed module do not require installation, and can be enabled directly for each application. This allows applications to include their managed modules directly within the application by registering them in the application's web.config file. %windir%\system32\inetsrv\config\applicationhost.config, and searching for the string "".
IIS Manager
The IIS Manager application allows for easy adding and removing of both Managed and Native modules.
AppCmd.exe
AppCmd by default is found in %windir%\system32\inetsrv. AppCmd.exe provides all sorts of functionality to manage IIS, but for this blog we will focus on listing, adding and removing modules.
To list modules:
%windir%\system32\inetsrv\appcmd.exe list modules
Add a module
%windir%\system32\inetsrv\appcmd.exe install module /name:DefaultDocumentModule_round2 /image:%windir%\system32\inetsrv\defdoc.dll
Uninstall a module
%windir%\system32\inetsrv\appcmd.exe uninstall module DefaultDocumentModule
PowerShell
Similar to AppCmd, PowerShell has cmdlets we may use to do similar functions.
List modules
Get-WebGlobalModule
Add new module
New-WebGlobalModule -Name DefaultDocumentModule_Atomic2 -Image %windir%\system32\inetsrv\defdoc.dll
Uninstall module
Remove-WebGlobalModule -Name DefaultDocumentModule_Atomic2