Windows Process Creation: China Chopper Webshell Command Pattern via W3WP

title: "Windows Process Creation: China Chopper Webshell Command Pattern via W3WP"
id: 02f3da78-0163-46cc-80ac-43c93705961d
status: test
description: This rule matches process creation events where w3wp.exe is the originating or parent process and the command line contains webshell-style execution strings consistent with China Chopper (tiny ASPX) webshell activity. Attackers commonly use webshells to run arbitrary commands in the context of the IIS worker process, enabling persistence and post-compromise discovery. Detection relies on Windows process_creation telemetry, using Image/ParentImage ending with w3wp.exe and specific command-line substrings indicating interactive command execution.
references:
  - https://www.microsoft.com/security/blog/2022/09/30/analyzing-attacks-using-the-exchange-vulnerabilities-cve-2022-41040-and-cve-2022-41082/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_webshell_chopper.yml
author: Florian Roth (Nextron Systems), MSTI (query), Huntrule Team
date: 2022-10-01
tags:
  - attack.persistence
  - attack.discovery
  - attack.t1505.003
  - attack.t1018
  - attack.t1033
  - attack.t1087
logsource:
  category: process_creation
  product: windows
detection:
  selection_origin:
    - Image|endswith: \w3wp.exe
    - ParentImage|endswith: \w3wp.exe
  selection_cmdline:
    CommandLine|contains:
      - "&ipconfig&echo"
      - "&quser&echo"
      - "&whoami&echo"
      - "&c:&echo"
      - "&cd&echo"
      - "&dir&echo"
      - "&echo [E]"
      - "&echo [S]"
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: fa3c117a-bc0d-416e-a31b-0c0e80653efb
    type: derived