Data Source: Powershell Installed IIS Modules

Date: 2025-01-23

ID: 4f2ccf42-3503-4417-a684-bfccf7f0d7b4

Author: Patrick Bareiss, Splunk

Description

Logs the list of installed IIS modules retrieved using PowerShell, including details about their names and statuses.

Details

Property	Value
Source	`powershell://AppCmdModules`
Sourcetype	`Pwsh:InstalledIISModules`

Event Fields

+ Fields

  <span class="pill kill-chain">_time</span>
  
  <span class="pill kill-chain">Schema</span>
  
  <span class="pill kill-chain">host</span>
  
  <span class="pill kill-chain">index</span>
  
  <span class="pill kill-chain">linecount</span>
  
  <span class="pill kill-chain">punct</span>
  
  <span class="pill kill-chain">source</span>
  
  <span class="pill kill-chain">sourcetype</span>
  
  <span class="pill kill-chain">splunk_server</span>
  
  <span class="pill kill-chain">timestamp</span>
  
</div>

Example Log

1Schema="Microsoft.IIs.PowerShell.Framework.ConfigurationElementSchema"

Source: GitHub | Version: 2