appcmd.exe
Summary
IIS Application Command Line Tool (appcmd.exe) is the command-line interface for managing Internet Information Services (IIS) web server configuration. It can manage sites, applications, application pools, virtual directories, and other IIS settings.
appcmd.exe is the 65th most commonly executed Windows program in EchoTrail's dataset, observed 459,785 times across enterprise environments. It typically runs from C:\Windows\System32\inetsrv and it is most often launched by LTSVC.exe.
Behavior
Top Paths
- C:\Windows\System32\inetsrv98.76%
- C:\Windows\SysWOW64\inetsrv1.24%
Top Hashes (SHA256)
- 9ad840cbb21e4ac99f0d3c5000f01d94fb94cfeef1d3e81cc9f50a7f23518a5087.85%
- 429bc84babe1387abf59eefb0b225a1f5317fdb1d3f29995dbd5604e78b3ac337.87%
- 12d18a89dba68b7b87e08284e1e56a3a60ecf796ec293406c653afd4c75959302.69%
- e1997829e5a0d5ec1327b68f194b803c5ea30ad9b42ba42d54387e16d3ae53f51.15%
- cc42dc58c7d76405154257f9162b7d99d6a62a1142c90fa3ba1c8900388d27e90.21%
- 1f0355a5601a02f31146aa2403198ed4c784703e463f78b9c398c8031b59403a0.08%
- 88b951612d04184460d9c918400cf137ed6b01623ddeafc689a506611e1481cb0.05%
- 4fb75def282e8a0b5c67a8da29c6cc8d1425c0ca3e13548b0d3ab03efa6df8600.03%
- ccd7e7635bd261815dfac9ab6edb52a9789c3275db09ea86a964f0e395bdba4a0.03%
- ee2e8bbdf80929c8d35b0cd8db26e583a5c851707c694ab5e90c4b6ae25db6830.02%
Process Ancestry
Top Grandparents
- services.exe55.42%
- TiWorker.exe39.16%
- msiexec.exe3.72%
Top Parents
- LTSVC.exe78.43%
- wsmprovhost.exe17.98%
- ekrn.exe1.11%
- cmd.exe0.2%
- WssPowerShell.exe0.08%
- iissetup.exe0.06%
- rundll32.exe0.01%
- powershell.exe<0.01%
- WmiPrvSE.exe<0.01%
Top Children
- conhost.exe100%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Security Analysis
What does appcmd.exe normally do?
Located in C:\Windows\System32\inetsrv or C:\Windows\SysWOW64\inetsrv. In this dataset, predominantly launched by LTSVC.exe (LabTech agent monitoring IIS) and wsmprovhost.exe (WinRM/PowerShell remoting). Spawns conhost.exe.
When is appcmd.exe suspicious?
Adding new virtual directories or applications pointing to unusual paths (potential webshell deployment). Modifying application pool credentials. Disabling logging or changing log paths. Executed by w3wp.exe (the web worker itself executing management commands suggests compromise). Changes made via wsmprovhost.exe (WinRM) from unexpected sources.
How do attackers abuse appcmd.exe?
Webshell deployment: appcmd can configure new IIS virtual directories pointing to attacker-controlled content. Credential access: appcmd list apppool /text:* can reveal application pool credentials. Log manipulation: disabling or redirecting IIS logs to cover tracks. Post-exploitation: after compromising a web server, attackers use appcmd to modify IIS configuration.
Detection guidance
Medium-confidence: appcmd adding new virtual directories or applications. appcmd modifying authentication or credential settings. appcmd disabling logging. High-confidence: w3wp.exe spawning or calling appcmd (web process managing itself suggests compromise). Correlate with IIS configuration change logs.
False positive notes
LabTech and other monitoring agents query IIS configuration regularly. WinRM-based management (wsmprovhost.exe) is common for remote IIS administration. Deployment pipelines may use appcmd during application releases.
Related Processes
Ask Rocky about appcmd.exe
Rocky answers questions about appcmd.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.