Microsoft IIS Service Account Password Dumped — Detection Rule
Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords
Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords