Windows Suspicious Child Processes Spawned by Web Server Executables

title: Windows Suspicious Child Processes Spawned by Web Server Executables
id: 0836678a-8df0-444b-94b1-e880523e7df2
status: test
description: This rule flags Windows process creation events where a web server process spawns a child process whose filename matches a list of common command execution, scripting, and system administration tools. Such behavior can indicate web shell activity or post-exploitation where an attacker leverages the web service context to run commands on the host. The detection relies on process creation telemetry including the parent executable path, the child process image path, and (where applicable) command line details for known benign patterns.
references:
  - https://media.defense.gov/2020/Jun/09/2002313081/-1/-1/0/CSI-DETECT-AND-PREVENT-WEB-SHELL-MALWARE-20200422.PDF
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_webshell_susp_process_spawned_from_webserver.yml
author: Thomas Patzke, Florian Roth (Nextron Systems), Zach Stanford @svch0st, Tim Shelton, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2019-01-16
modified: 2024-11-26
tags:
  - attack.persistence
  - attack.initial-access
  - attack.t1505.003
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_webserver_image:
    ParentImage|endswith:
      - \caddy.exe
      - \httpd.exe
      - \nginx.exe
      - \php-cgi.exe
      - \php.exe
      - \tomcat.exe
      - \UMWorkerProcess.exe
      - \w3wp.exe
      - \ws_TomcatService.exe
  selection_webserver_characteristics_tomcat1:
    ParentImage|endswith:
      - \java.exe
      - \javaw.exe
    ParentImage|contains:
      - -tomcat-
      - \tomcat
  selection_webserver_characteristics_tomcat2:
    ParentImage|endswith:
      - \java.exe
      - \javaw.exe
    ParentCommandLine|contains:
      - CATALINA_HOME
      - catalina.home
      - catalina.jar
  selection_anomaly_children:
    Image|endswith:
      - \arp.exe
      - \at.exe
      - \bash.exe
      - \bitsadmin.exe
      - \certutil.exe
      - \cmd.exe
      - \cscript.exe
      - \dsget.exe
      - \hostname.exe
      - \nbtstat.exe
      - \net.exe
      - \net1.exe
      - \netdom.exe
      - \netsh.exe
      - \nltest.exe
      - \ntdsutil.exe
      - \powershell_ise.exe
      - \powershell.exe
      - \pwsh.exe
      - \qprocess.exe
      - \query.exe
      - \qwinsta.exe
      - \reg.exe
      - \rundll32.exe
      - \sc.exe
      - \sh.exe
      - \wmic.exe
      - \wscript.exe
      - \wusa.exe
  filter_main_fp_1:
    ParentImage|endswith: \java.exe
    CommandLine|endswith: Windows\system32\cmd.exe /c C:\ManageEngine\ADManager "Plus\ES\bin\elasticsearch.bat -Enode.name=RMP-NODE1 -pelasticsearch-pid.txt
  filter_main_fp_2:
    ParentImage|endswith: \java.exe
    CommandLine|contains|all:
      - sc query
      - ADManager Plus
  condition: 1 of selection_webserver_* and selection_anomaly_children and not 1 of filter_main_*
falsepositives:
  - Particular web applications may spawn a shell process legitimately
level: high
license: DRL-1.1
related:
  - id: 8202070f-edeb-4d31-a010-a26c72ac5600
    type: derived