Windows Process Creation: China Chopper Webshell Command Pattern via W3WP
Flags w3wp.exe-launched commands matching China Chopper webshell execution patterns in Windows process creation logs.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems), MSTI (query) (SigmaHQ), DRL 1.1
- Published
- 2022-10-01
- Updated
- 2026-07-30
ATT&CK techniques
Persistence → DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule matches process creation events where w3wp.exe is the originating or parent process and the command line contains webshell-style execution strings consistent with China Chopper (tiny ASPX) webshell activity. Attackers commonly use webshells to run arbitrary commands in the context of the IIS worker process, enabling persistence and post-compromise discovery. Detection relies on Windows process_creation telemetry, using Image/ParentImage ending with w3wp.exe and specific command-line substrings indicating interactive command execution.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: China Chopper Webshell Command Pattern via W3WP"
id: 02f3da78-0163-46cc-80ac-43c93705961d
status: test
description: This rule matches process creation events where w3wp.exe is the originating or parent process and the command line contains webshell-style execution strings consistent with China Chopper (tiny ASPX) webshell activity. Attackers commonly use webshells to run arbitrary commands in the context of the IIS worker process, enabling persistence and post-compromise discovery. Detection relies on Windows process_creation telemetry, using Image/ParentImage ending with w3wp.exe and specific command-line substrings indicating interactive command execution.
references:
- https://www.microsoft.com/security/blog/2022/09/30/analyzing-attacks-using-the-exchange-vulnerabilities-cve-2022-41040-and-cve-2022-41082/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_webshell_chopper.yml
author: Florian Roth (Nextron Systems), MSTI (query), Huntrule Team
date: 2022-10-01
tags:
- attack.persistence
- attack.discovery
- attack.t1505.003
- attack.t1018
- attack.t1033
- attack.t1087
logsource:
category: process_creation
product: windows
detection:
selection_origin:
- Image|endswith: \w3wp.exe
- ParentImage|endswith: \w3wp.exe
selection_cmdline:
CommandLine|contains:
- "&ipconfig&echo"
- "&quser&echo"
- "&whoami&echo"
- "&c:&echo"
- "&cd&echo"
- "&dir&echo"
- "&echo [E]"
- "&echo [S]"
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: fa3c117a-bc0d-416e-a31b-0c0e80653efb
type: derived