Windows Suspicious Child Processes Spawned by Web Server Executables
Alerts when web server processes (e.g., nginx/httpd/caddy/php/tomcat) spawn suspicious Windows command/scripting executables.
- Product
- windows
- Category
- process_creation
- Author
- Thomas Patzke, Florian Roth (Nextron Systems), Zach Stanford @svch0st, Tim Shelton, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2019-01-16
- Updated
- 2026-07-30
ATT&CK techniques
Initial Access → PersistenceRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation events where a web server process spawns a child process whose filename matches a list of common command execution, scripting, and system administration tools. Such behavior can indicate web shell activity or post-exploitation where an attacker leverages the web service context to run commands on the host. The detection relies on process creation telemetry including the parent executable path, the child process image path, and (where applicable) command line details for known benign patterns.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Suspicious Child Processes Spawned by Web Server Executables
id: 0836678a-8df0-444b-94b1-e880523e7df2
status: test
description: This rule flags Windows process creation events where a web server process spawns a child process whose filename matches a list of common command execution, scripting, and system administration tools. Such behavior can indicate web shell activity or post-exploitation where an attacker leverages the web service context to run commands on the host. The detection relies on process creation telemetry including the parent executable path, the child process image path, and (where applicable) command line details for known benign patterns.
references:
- https://media.defense.gov/2020/Jun/09/2002313081/-1/-1/0/CSI-DETECT-AND-PREVENT-WEB-SHELL-MALWARE-20200422.PDF
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_webshell_susp_process_spawned_from_webserver.yml
author: Thomas Patzke, Florian Roth (Nextron Systems), Zach Stanford @svch0st, Tim Shelton, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2019-01-16
modified: 2024-11-26
tags:
- attack.persistence
- attack.initial-access
- attack.t1505.003
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection_webserver_image:
ParentImage|endswith:
- \caddy.exe
- \httpd.exe
- \nginx.exe
- \php-cgi.exe
- \php.exe
- \tomcat.exe
- \UMWorkerProcess.exe
- \w3wp.exe
- \ws_TomcatService.exe
selection_webserver_characteristics_tomcat1:
ParentImage|endswith:
- \java.exe
- \javaw.exe
ParentImage|contains:
- -tomcat-
- \tomcat
selection_webserver_characteristics_tomcat2:
ParentImage|endswith:
- \java.exe
- \javaw.exe
ParentCommandLine|contains:
- CATALINA_HOME
- catalina.home
- catalina.jar
selection_anomaly_children:
Image|endswith:
- \arp.exe
- \at.exe
- \bash.exe
- \bitsadmin.exe
- \certutil.exe
- \cmd.exe
- \cscript.exe
- \dsget.exe
- \hostname.exe
- \nbtstat.exe
- \net.exe
- \net1.exe
- \netdom.exe
- \netsh.exe
- \nltest.exe
- \ntdsutil.exe
- \powershell_ise.exe
- \powershell.exe
- \pwsh.exe
- \qprocess.exe
- \query.exe
- \qwinsta.exe
- \reg.exe
- \rundll32.exe
- \sc.exe
- \sh.exe
- \wmic.exe
- \wscript.exe
- \wusa.exe
filter_main_fp_1:
ParentImage|endswith: \java.exe
CommandLine|endswith: Windows\system32\cmd.exe /c C:\ManageEngine\ADManager "Plus\ES\bin\elasticsearch.bat -Enode.name=RMP-NODE1 -pelasticsearch-pid.txt
filter_main_fp_2:
ParentImage|endswith: \java.exe
CommandLine|contains|all:
- sc query
- ADManager Plus
condition: 1 of selection_webserver_* and selection_anomaly_children and not 1 of filter_main_*
falsepositives:
- Particular web applications may spawn a shell process legitimately
level: high
license: DRL-1.1
related:
- id: 8202070f-edeb-4d31-a010-a26c72ac5600
type: derived