- Product name
- Publisher page
-
- [Microsoft|Microsoft]
- Category
- Application Server Software Platforms
- Release
- TKU 2023-May-1
- More information
- Publisher link
Extended Discovery pattern which allows to model "Website", "FTP Server", "Web Application", "Virtual Directory" and "Application Pool" is available for this product.
Microsoft Internet Information Services (IIS, formerly called Internet Information Server) is a set of Internet-based services for servers using Microsoft Windows.
The servers currently include FTP, SMTP, NNTP, WebDAV and HTTP/HTTPS.
| Product Component | OS Type | Versioning | Pattern Depth |
|---|---|---|---|
| Microsoft IIS Service | Windows | Registry and OS Inferences | Instance Based |
| Microsoft IIS Webserver | |||
| Microsoft FTP Server |
As the software is integrated within the Windows Operating System kernel, it cannot be run on any other Operating System - as such the patterns only identify Windows installations.
Software Instance Triggers
The following patterns will only run on Windows 2003 or earlier:
| Pattern | Trigger Node | Attribute | Condition | Argument | False positive checking |
|---|---|---|---|---|---|
| IIS | DiscoveredProcess | cmd | matches |
| |
| IISWebserver | DiscoveredProcess | cmd | matches |
| |
| args | matches |
| |||
| FTPServer | DiscoveredProcess | cmd | matches |
| {escapeall}%systemroot%\system32\inetsrv\Metabase.xml{escapeall} must contain regex '(?i)iisftpserver'. %systemroot% is a Windows environment variable |
| args | matches |
|
The following patterns will only run on Windows Vista or later:
| Pattern | Trigger Node | Attribute | Condition | Argument |
|---|---|---|---|---|
| IISWebserver_7 | DiscoveredProcess | cmd | matches |
|
| args | matches |
| ||
| IISFTPServer_7 | DiscoveredProcess | cmd | matches |
|
| args | matches |
| ||
| IIS_7 | DiscoveredProcess | cmd | matches |
|
| args | matches |
|
Simple Identification Mappings
The following processes are identified through the use of Simple Identifiers and are modeled within a full Software Instance for Microsoft Internet Information Services using the primary and associate relationships (See Application Model Produced by Software Pattern for more details about modeling this product).
| Name | Command | Arguments |
|---|---|---|
| Microsoft IIS WebDAV Service |
| |
| Microsoft ASP.net Worker Process |
| |
| Microsoft IIS Worker Process |
| |
| Microsoft IIS Webserver - IIS 6.0 and above |
|
|
| Microsoft IIS FTP Server |
|
|
| Microsoft IIS Service |
|
Version information for this product is currently collected using one of two possible methods, either checking the registry for an explicit version number or by checking the operating system for a version that we know maps 1:1 with a specific version of IIS.
