Threat actors are increasingly abusing Internet Information Services (IIS) extensions to backdoor servers as a means of establishing a “durable persistence mechanism.”
That’s according to a new warning from the Microsoft 365 Defender Research Team, which said that “IIS backdoors are also harder to detect since they mostly reside in the same directories as legitimate modules used by target
lecrab