appcmd.exe

by Microsoft
Operating Systemmedium risk

Sources: 300M+ executions observed in the wild.

Summary

IIS Application Command Line Tool (appcmd.exe) is the command-line interface for managing Internet Information Services (IIS) web server configuration. It can manage sites, applications, application pools, virtual directories, and other IIS settings.

appcmd.exe is the 65th most commonly executed Windows program in EchoTrail's dataset, observed 459,785 times across enterprise environments. It typically runs from C:\Windows\System32\inetsrv and it is most often launched by LTSVC.exe.

Get this in your tools

The same record for appcmd.exe, by REST or as an MCP tool. Free key, no card.

Get a free key
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
  https://api.echotrail.io/v1/process/appcmd.exe

Free returns the summary. Team returns the full record you see on this page. Endpoint docs

65th
most commonly executed Windows program
459,785
observed endpoint executions

Behavior

Top Paths

  • C:\Windows\System32\inetsrv98.76%
  • C:\Windows\SysWOW64\inetsrv1.24%

Top Hashes (SHA256)

  • 9ad840cbb21e4ac99f0d3c5000f01d94fb94cfeef1d3e81cc9f50a7f23518a5087.85%
  • 429bc84babe1387abf59eefb0b225a1f5317fdb1d3f29995dbd5604e78b3ac337.87%
  • 12d18a89dba68b7b87e08284e1e56a3a60ecf796ec293406c653afd4c75959302.69%
  • e1997829e5a0d5ec1327b68f194b803c5ea30ad9b42ba42d54387e16d3ae53f51.15%
  • cc42dc58c7d76405154257f9162b7d99d6a62a1142c90fa3ba1c8900388d27e90.21%
  • 1f0355a5601a02f31146aa2403198ed4c784703e463f78b9c398c8031b59403a0.08%
  • 88b951612d04184460d9c918400cf137ed6b01623ddeafc689a506611e1481cb0.05%
  • 4fb75def282e8a0b5c67a8da29c6cc8d1425c0ca3e13548b0d3ab03efa6df8600.03%
  • ccd7e7635bd261815dfac9ab6edb52a9789c3275db09ea86a964f0e395bdba4a0.03%
  • ee2e8bbdf80929c8d35b0cd8db26e583a5c851707c694ab5e90c4b6ae25db6830.02%

Process Ancestry

Top Grandparents

Top Parents

Top Children

Security Analysis

What does appcmd.exe normally do?

Located in C:\Windows\System32\inetsrv or C:\Windows\SysWOW64\inetsrv. In this dataset, predominantly launched by LTSVC.exe (LabTech agent monitoring IIS) and wsmprovhost.exe (WinRM/PowerShell remoting). Spawns conhost.exe.

When is appcmd.exe suspicious?

Adding new virtual directories or applications pointing to unusual paths (potential webshell deployment). Modifying application pool credentials. Disabling logging or changing log paths. Executed by w3wp.exe (the web worker itself executing management commands suggests compromise). Changes made via wsmprovhost.exe (WinRM) from unexpected sources.

How do attackers abuse appcmd.exe?

Webshell deployment: appcmd can configure new IIS virtual directories pointing to attacker-controlled content. Credential access: appcmd list apppool /text:* can reveal application pool credentials. Log manipulation: disabling or redirecting IIS logs to cover tracks. Post-exploitation: after compromising a web server, attackers use appcmd to modify IIS configuration.

Detection guidance

Medium-confidence: appcmd adding new virtual directories or applications. appcmd modifying authentication or credential settings. appcmd disabling logging. High-confidence: w3wp.exe spawning or calling appcmd (web process managing itself suggests compromise). Correlate with IIS configuration change logs.

False positive notes

LabTech and other monitoring agents query IIS configuration regularly. WinRM-based management (wsmprovhost.exe) is common for remote IIS administration. Deployment pipelines may use appcmd during application releases.

MITRE ATT&CK techniques

Related Processes

Ask Rocky about appcmd.exe

Rocky is the free chat demo. It answers from this same dataset, no account needed.

This page is the Team-tier API record for appcmd.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.