Previously Installed IIS Module Was Removed (9e1a1fdf-ee58-40ce-8e15-b66ca5a80e1f)

Detects the removal of a previously installed IIS module.

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
IIS Components - T1505.004 (b46a801b-fd98-491c-a25a-bca25d6e3001)	Attack Pattern	Previously Installed IIS Module Was Removed (9e1a1fdf-ee58-40ce-8e15-b66ca5a80e1f)	Sigma-Rules	1
Disable or Modify Windows Event Log - T1685.001 (1411e6b8-80a6-4465-9909-54eaa9c67ce0)	Attack Pattern	Previously Installed IIS Module Was Removed (9e1a1fdf-ee58-40ce-8e15-b66ca5a80e1f)	Sigma-Rules	1
IIS Components - T1505.004 (b46a801b-fd98-491c-a25a-bca25d6e3001)	Attack Pattern	Server Software Component - T1505 (d456de47-a16f-4e46-8980-e67478a12dcb)	Attack Pattern	2
Disable or Modify Tools - T1685 (bbde9781-60aa-4b8a-a911-895b0c1b3872)	Attack Pattern	Disable or Modify Windows Event Log - T1685.001 (1411e6b8-80a6-4465-9909-54eaa9c67ce0)	Attack Pattern	2