Windows IIS Server PSWA Console Access


Description

This analytic detects access attempts to the PowerShell Web Access (PSWA) console on Windows IIS servers. It monitors web traffic for requests to PSWA-related URIs, which could indicate legitimate administrative activity or potential unauthorized access attempts. By tracking source IP, HTTP status, URI path, and HTTP method, it helps identify suspicious patterns or brute-force attacks targeting PSWA. This detection is crucial for maintaining the security of remote PowerShell management interfaces and preventing potential exploitation of this powerful administrative tool.

Query · spl

| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
  WHERE Web.dest IN ("/pswa/*")
  BY Web.src Web.status Web.uri_path
     Web.dest Web.http_method Web.uri_query
| `drop_dm_object_name("Web")`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_iis_server_pswa_console_access_filter`

Implementation guide

To successfully implement this search you need to be ingesting information on Web traffic, Exchange OR IIS logs, mapped to Web datamodel in the Web node. In addition, confirm the latest CIM App 4.20 or higher is installed.

Known false positives

  • False positives may occur if legitimate PSWA processes are used for administrative tasks. Careful review of the logs is recommended to distinguish between legitimate and malicious activity.

Analyst notes

Known false positives: False positives may occur if legitimate PSWA processes are used for administrative tasks. Careful review of the logs is recommended to distinguish between legitimate and malicious activity.

Raw source Windows IIS Server PSWA Console Access · SPL
Esc
Published by splunk/security_content ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified.
name: Windows IIS Server PSWA Console Access
id: 914ab191-fa8a-48cb-83a6-0565e061f934
version: 6
creation_date: '2024-09-30'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Hunting
description: This analytic detects access attempts to the PowerShell Web Access (PSWA) console on Windows IIS servers. It monitors web traffic for requests to PSWA-related URIs, which could indicate legitimate administrative activity or potential unauthorized access attempts. By tracking source IP, HTTP status, URI path, and HTTP method, it helps identify suspicious patterns or brute-force attacks targeting PSWA. This detection is crucial for maintaining the security of remote PowerShell management interfaces and preventing potential exploitation of this powerful administrative tool.
data_source:
    - Windows IIS
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
      WHERE Web.dest IN ("/pswa/*")
      BY Web.src Web.status Web.uri_path
         Web.dest Web.http_method Web.uri_query
    | `drop_dm_object_name("Web")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_iis_server_pswa_console_access_filter`
how_to_implement: To successfully implement this search you need to be ingesting information on Web traffic, Exchange OR IIS logs, mapped to `Web` datamodel in the `Web` node. In addition, confirm the latest CIM App 4.20 or higher is installed.
known_false_positives: False positives may occur if legitimate PSWA processes are used for administrative tasks. Careful review of the logs is recommended to distinguish between legitimate and malicious activity.
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a
analytic_story:
    - CISA AA24-241A
asset_type: Web Server
mitre_attack_id:
    - T1190
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network
tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/pswa/iis_pswaaccess.log
          sourcetype: ms:iis:splunk
          source: ms:iis:splunk
      test_type: unit

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.