Windows Suspicious Child Processes Spawned by Web Server Executables

Alerts when web server processes (e.g., nginx/httpd/caddy/php/tomcat) spawn suspicious Windows command/scripting executables.

FreeReviewedSigma · High · v1

Product: windows
Category: process_creation
Author: Thomas Patzke, Florian Roth (Nextron Systems), Zach Stanford @svch0st, Tim Shelton, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2019-01-16
Updated: 2026-07-30

Analysis Detection

ATT&CK techniques

Initial Access → Persistence

Recon
Resource Dev
Initial Access
- T1190Exploit Public-Facing Application
Execution
Persistence
- T1505.003Web Shell
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows process creation events where a web server process spawns a child process whose filename matches a list of common command execution, scripting, and system administration tools. Such behavior can indicate web shell activity or post-exploitation where an attacker leverages the web service context to run commands on the host. The detection relies on process creation telemetry including the parent executable path, the child process image path, and (where applicable) command line details for known benign patterns.

Reporting behind it

Related detections9 linkedT1190 — drag to rearrange

Malicious Web Shell Written to SharePoint LAYOUTS Directory by Worker Process (via file_event)

Malicious Command Shell Spawned by SQL Server via Process Creation (via process_creation)

Possible GoAnywhere MFT Exploitation via Tomcat Spawning Discovery Commands

Suspicious Command Shell Spawned by MSSQL Server Process Indicating Webshell

Malicious MOVEit Transfer Exploitation via X-siLock HTTP Headers (via webserver)

Malicious IIS w3wp Worker Spawning Command Interpreter via SharePoint Web Shell

Suspicious Single-Character Named Executable Launched by Web Server Process (via process_creation)

Malicious MOVEit human2.aspx Web Shell Dropped in wwwroot (via file_event)

Malicious IIS Worker Process Spawning PowerShell via Gladinet CentreStack Exploit

Windows Suspicious Child Processes Spawned by Web Server Executables

Pivot detection · T1190 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-suspicious-child-processes-spawned-by-web-server-executables-8202070f

title: Windows Suspicious Child Processes Spawned by Web Server Executables
id: 0836678a-8df0-444b-94b1-e880523e7df2
status: test
description: This rule flags Windows process creation events where a web server process spawns a child process whose filename matches a list of common command execution, scripting, and system administration tools. Such behavior can indicate web shell activity or post-exploitation where an attacker leverages the web service context to run commands on the host. The detection relies on process creation telemetry including the parent executable path, the child process image path, and (where applicable) command line details for known benign patterns.
references:
  - https://media.defense.gov/2020/Jun/09/2002313081/-1/-1/0/CSI-DETECT-AND-PREVENT-WEB-SHELL-MALWARE-20200422.PDF
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_webshell_susp_process_spawned_from_webserver.yml
author: Thomas Patzke, Florian Roth (Nextron Systems), Zach Stanford @svch0st, Tim Shelton, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2019-01-16
modified: 2024-11-26
tags:
  - attack.persistence
  - attack.initial-access
  - attack.t1505.003
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_webserver_image:
    ParentImage|endswith:
      - \caddy.exe
      - \httpd.exe
      - \nginx.exe
      - \php-cgi.exe
      - \php.exe
      - \tomcat.exe
      - \UMWorkerProcess.exe
      - \w3wp.exe
      - \ws_TomcatService.exe
  selection_webserver_characteristics_tomcat1:
    ParentImage|endswith:
      - \java.exe
      - \javaw.exe
    ParentImage|contains:
      - -tomcat-
      - \tomcat
  selection_webserver_characteristics_tomcat2:
    ParentImage|endswith:
      - \java.exe
      - \javaw.exe
    ParentCommandLine|contains:
      - CATALINA_HOME
      - catalina.home
      - catalina.jar
  selection_anomaly_children:
    Image|endswith:
      - \arp.exe
      - \at.exe
      - \bash.exe
      - \bitsadmin.exe
      - \certutil.exe
      - \cmd.exe
      - \cscript.exe
      - \dsget.exe
      - \hostname.exe
      - \nbtstat.exe
      - \net.exe
      - \net1.exe
      - \netdom.exe
      - \netsh.exe
      - \nltest.exe
      - \ntdsutil.exe
      - \powershell_ise.exe
      - \powershell.exe
      - \pwsh.exe
      - \qprocess.exe
      - \query.exe
      - \qwinsta.exe
      - \reg.exe
      - \rundll32.exe
      - \sc.exe
      - \sh.exe
      - \wmic.exe
      - \wscript.exe
      - \wusa.exe
  filter_main_fp_1:
    ParentImage|endswith: \java.exe
    CommandLine|endswith: Windows\system32\cmd.exe /c C:\ManageEngine\ADManager "Plus\ES\bin\elasticsearch.bat -Enode.name=RMP-NODE1 -pelasticsearch-pid.txt
  filter_main_fp_2:
    ParentImage|endswith: \java.exe
    CommandLine|contains|all:
      - sc query
      - ADManager Plus
  condition: 1 of selection_webserver_* and selection_anomaly_children and not 1 of filter_main_*
falsepositives:
  - Particular web applications may spawn a shell process legitimately
level: high
license: DRL-1.1
related:
  - id: 8202070f-edeb-4d31-a010-a26c72ac5600
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL