🧰 appcmd.exe

The items that name it 4

• Determined Attacker Uploads Malicious Webshells to Parks and Rec Management Platform Servers
  writeup2026-09-30

  Standard Windows/IIS administration tool used by the attacker to enumerate IIS sites, virtual directories, and applications

• Threat Actors Achieve Persistence After SQL Injection
  writeup2026-07-13

  Used by the threat actor to install BadIIS malicious modules (HttpFastCgiModule.dll and HttpCgiModule.dll) into IIS.

• Defence Impairment Olympics
  writeup2026-06-29

  IIS command-line tool used by the threat actor to disable HTTP logging, enumerate hosted sites/virtual directories, and uninstall the ModSecurity IIS module

• Two in a row - You mitigated wrong (Kentico CMS RCE)
  writeup2024-03-06

  IIS command-line management tool abused by attacker to install malicious rewrite rules and register malicious IIS module (HTTPCacheLog.dll)