Windows Process Execution From Web Server Root Directories

title: Windows Process Execution From Web Server Root Directories
id: 3041c03a-d891-4c9a-bb41-355d70ba122e
status: test
description: This rule flags Windows processes whose executable path includes common web server root folders such as \wwwroot\, \wmpub\, or \htdocs\. Attackers commonly place webshells or backdoors under these directories and then execute them in place to maintain persistence and evade detection. The detection relies on process creation telemetry, specifically the process Image path and the ParentImage ending with \services.exe for exclusion filtering.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_susp_execution_path_webserver.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2019-01-16
modified: 2024-01-18
tags:
  - attack.persistence
  - attack.t1505.003
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains:
      - \wwwroot\
      - \wmpub\
      - \htdocs\
  filter_main_generic:
    Image|contains:
      - bin\
      - \Tools\
      - \SMSComponent\
    ParentImage|endswith: \services.exe
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Various applications
  - Tools that include ping or nslookup command invocations
level: medium
license: DRL-1.1
related:
  - id: 35efb964-e6a5-47ad-bbcd-19661854018d
    type: derived