IIS configuration credential dump
appcmd.exe was used to read IIS credentials out of the server configuration.
What it detects
appcmd.exe was used to read IIS credentials out of the server configuration.
IIS stores two kinds of usable secret in applicationHost.config: the identity an application pool runs as (processmodel.username / processmodel.password) and the account a virtual directory uses to reach a remote share (userName / password). appcmd list … /text:password prints them, and IIS decrypts them for the caller — so this is a plaintext credential dump performed by a signed Microsoft tool with no memory access, no dropped binary, and nothing an anti-malware product objects to.
App-pool identities are frequently domain accounts with rights on other systems, which is why this so often turns a single compromised web server into a foothold in the domain. It is the natural follow-on to a webshell.
MITRE ATT&CK mapping
False positives and triage
Administrators and configuration-management tooling do read app-pool identities when auditing or migrating a server, so the username half has occasional legitimate use. Reading password has essentially none — an administrator who needs to change it sets a new one rather than printing the old.
To confirm: look at what ran appcmd and what ran before it. A webshell's process tree (w3wp.exe as an ancestor) or an encoded PowerShell command in the same session makes this conclusive — a real capture in the benchmark corpus pairs it with powershell -nop -noni -enc. Treat every app-pool and virtual-directory account on that server as disclosed and rotate them; check where those accounts are also valid, because that is where the intruder goes next.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 90%. Source: rules/windows/iis_configuration_credential_dump.yaml, licensed under the Apache License 2.0.
id: windows.credential.iis_configuration_credential_dump
version: 1.0.0
status: stable
severity: critical
confidence: 0.9
platforms: [windows]
mitre_techniques: [T1552.001, T1078.002]
description: |
`appcmd.exe` was used to read IIS credentials out of the server configuration.
IIS stores two kinds of usable secret in `applicationHost.config`: the identity an
application pool runs as (`processmodel.username` / `processmodel.password`) and the
account a virtual directory uses to reach a remote share (`userName` / `password`).
`appcmd list … /text:password` prints them, and IIS decrypts them for the caller —
so this is a plaintext credential dump performed by a signed Microsoft tool with no
memory access, no dropped binary, and nothing an anti-malware product objects to.
App-pool identities are frequently domain accounts with rights on other systems,
which is why this so often turns a single compromised web server into a foothold in
the domain. It is the natural follow-on to a webshell.
match:
process_name_contains_any: [appcmd]
command_line_regex: '(?i)/text:\s*"?(processmodel\.)?(password|username)'
correlation_keys: [hostname, user_name]
false_positive_guidance: |
Administrators and configuration-management tooling do read app-pool identities when
auditing or migrating a server, so the `username` half has occasional legitimate
use. Reading `password` has essentially none — an administrator who needs to change
it sets a new one rather than printing the old.
To confirm: look at what ran `appcmd` and what ran before it. A webshell's process
tree (`w3wp.exe` as an ancestor) or an encoded PowerShell command in the same
session makes this conclusive — a real capture in the benchmark corpus pairs it with
`powershell -nop -noni -enc`. Treat every app-pool and virtual-directory account on
that server as disclosed and rotate them; check where those accounts are also valid,
because that is where the intruder goes next.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.