Microsoft IIS Service Account Password Dumped — Detection Rule

Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords

Read the full analysis on IntelFusions