appcmd.exe
Sources: 300M+ executions observed in the wild.
Summary
IIS Application Command Line Tool (appcmd.exe) is the command-line interface for managing Internet Information Services (IIS) web server configuration. It can manage sites, applications, application pools, virtual directories, and other IIS settings.
appcmd.exe is the 65th most commonly executed Windows program in EchoTrail's dataset, observed 459,785 times across enterprise environments. It typically runs from C:\Windows\System32\inetsrv and it is most often launched by LTSVC.exe.
Get this in your tools
The same record for appcmd.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/appcmd.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
Behavior
Top Paths
- C:\Windows\System32\inetsrv98.76%
- C:\Windows\SysWOW64\inetsrv1.24%
Top Hashes (SHA256)
- 9ad840cbb21e4ac99f0d3c5000f01d94fb94cfeef1d3e81cc9f50a7f23518a5087.85%
- 429bc84babe1387abf59eefb0b225a1f5317fdb1d3f29995dbd5604e78b3ac337.87%
- 12d18a89dba68b7b87e08284e1e56a3a60ecf796ec293406c653afd4c75959302.69%
- e1997829e5a0d5ec1327b68f194b803c5ea30ad9b42ba42d54387e16d3ae53f51.15%
- cc42dc58c7d76405154257f9162b7d99d6a62a1142c90fa3ba1c8900388d27e90.21%
- 1f0355a5601a02f31146aa2403198ed4c784703e463f78b9c398c8031b59403a0.08%
- 88b951612d04184460d9c918400cf137ed6b01623ddeafc689a506611e1481cb0.05%
- 4fb75def282e8a0b5c67a8da29c6cc8d1425c0ca3e13548b0d3ab03efa6df8600.03%
- ccd7e7635bd261815dfac9ab6edb52a9789c3275db09ea86a964f0e395bdba4a0.03%
- ee2e8bbdf80929c8d35b0cd8db26e583a5c851707c694ab5e90c4b6ae25db6830.02%
Process Ancestry
Top Grandparents
- services.exe55.42%
- TiWorker.exe39.16%
- msiexec.exe3.72%
Top Parents
- LTSVC.exe78.43%
- wsmprovhost.exe17.98%
- ekrn.exe1.11%
- cmd.exe0.2%
- WssPowerShell.exe0.08%
- iissetup.exe0.06%
- rundll32.exe0.01%
- powershell.exe<0.01%
- WmiPrvSE.exe<0.01%
Top Children
- conhost.exe100%
Security Analysis
What does appcmd.exe normally do?
Located in C:\Windows\System32\inetsrv or C:\Windows\SysWOW64\inetsrv. In this dataset, predominantly launched by LTSVC.exe (LabTech agent monitoring IIS) and wsmprovhost.exe (WinRM/PowerShell remoting). Spawns conhost.exe.
When is appcmd.exe suspicious?
Adding new virtual directories or applications pointing to unusual paths (potential webshell deployment). Modifying application pool credentials. Disabling logging or changing log paths. Executed by w3wp.exe (the web worker itself executing management commands suggests compromise). Changes made via wsmprovhost.exe (WinRM) from unexpected sources.
How do attackers abuse appcmd.exe?
Webshell deployment: appcmd can configure new IIS virtual directories pointing to attacker-controlled content. Credential access: appcmd list apppool /text:* can reveal application pool credentials. Log manipulation: disabling or redirecting IIS logs to cover tracks. Post-exploitation: after compromising a web server, attackers use appcmd to modify IIS configuration.
Detection guidance
Medium-confidence: appcmd adding new virtual directories or applications. appcmd modifying authentication or credential settings. appcmd disabling logging. High-confidence: w3wp.exe spawning or calling appcmd (web process managing itself suggests compromise). Correlate with IIS configuration change logs.
False positive notes
LabTech and other monitoring agents query IIS configuration regularly. WinRM-based management (wsmprovhost.exe) is common for remote IIS administration. Deployment pipelines may use appcmd during application releases.
Related Processes
Ask Rocky about appcmd.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for appcmd.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.