during uninstallation of the iis service

source: <a href=https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_delete/file_delete_win_delete_iis_access_logs.yml>sigma
technicques: t1070

Techniques

Detects the deletion of IIS WebServer access logs which may indicate an attempt to destroy forensic evidence

condition: selection
selection:
  TargetFilename|contains: \inetpub\logs\LogFiles\
  TargetFilename|endswith: .log