Windows File Creation: Suspicious Webshell Script Extensions in Web Root

Alerts on Windows creation of script-like files with webshell extensions in web root directories, excluding common benign temp and XAMPP paths.

FreeUnreviewedSigmamediumv1

windows-file-creation-suspicious-webshell-script-extensions-in-web-root-39f1f9f2

title: "Windows File Creation: Suspicious Webshell Script Extensions in Web Root"
id: 5d8954c2-617c-4972-969e-2beef3778d60
status: test
description: This rule flags Windows file creation events where the target path is under common static web directories and the filename contains webshell-relevant extensions (.ashx, .asp, .ph, .soap, or .ph). Attackers can use these server-side script file drops to establish persistent remote code execution via the web server. The detection relies on Windows file event telemetry that records TargetFilename, along with basic exclusions for temporary paths, the System image, and XAMPP.
references:
  - PT ESC rule and personal experience
  - https://github.com/swisskyrepo/PayloadsAllTheThings/blob/c95a0a1a2855dc0cd7f7327614545fe30482a636/Upload%20Insecure%20Files/README.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_webshell_creation_detect.yml
author: Beyu Denis, oscd.community, Tim Shelton, Thurein Oo, Huntrule Team
date: 2019-10-22
modified: 2023-10-15
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  product: windows
  category: file_event
detection:
  selection_wwwroot_path:
    TargetFilename|contains: \inetpub\wwwroot\
  selection_wwwroot_ext:
    TargetFilename|contains:
      - .ashx
      - .asp
      - .ph
      - .soap
  selection_htdocs_path:
    TargetFilename|contains:
      - \www\
      - \htdocs\
      - \html\
  selection_htdocs_ext:
    TargetFilename|contains: .ph
  filter_main_temp:
    TargetFilename|contains:
      - \AppData\Local\Temp\
      - \Windows\Temp\
  filter_main_system:
    Image: System
  filter_main_legitimate:
    TargetFilename|contains: \xampp
  condition: (all of selection_wwwroot_* or all of selection_htdocs_*) and not 1 of filter_main_*
falsepositives:
  - Legitimate administrator or developer creating legitimate executable files in a web application folder
level: medium
license: DRL-1.1
related:
  - id: 39f1f9f2-9636-45de-98f6-a4046aa8e4b9
    type: derived

What it detects

This rule flags Windows file creation events where the target path is under common static web directories and the filename contains webshell-relevant extensions (.ashx, .asp, .ph, .soap, or .ph). Attackers can use these server-side script file drops to establish persistent remote code execution via the web server. The detection relies on Windows file event telemetry that records TargetFilename, along with basic exclusions for temporary paths, the System image, and XAMPP.

Known false positives

Legitimate administrator or developer creating legitimate executable files in a web application folder

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.