Windows Suspicious File Write to Apache/Tomcat webapps ROOT (.jsp) by Web Server Processes

Alerts on .jsp writes into Apache/Tomcat webapps ROOT from dotnet/java/IIS worker processes on Windows.

FreeReviewedSigma · Medium · v2

Product: windows
Category: file_event
Author: Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2025-10-20
Updated: 2026-07-31

ATT&CK techniques

Initial Access → Persistence

Recon
Resource Dev
Initial Access
- T1190Exploit Public-Facing Application
Execution
Persistence
- T1505.003Web Shell
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags file creation or modification events where the target path is the webapps ROOT directory and the written file ends with .jsp. It focuses on activity where the originating process image name is dotnet.exe, w3wp.exe (IIS worker), or java.exe, and where the filename path contains apache or tomcat. Such behavior can indicate an attacker attempting to deploy unauthorized server-side scripts (e.g., web shells). Telemetry required includes Windows file event data with process image and target filename/path fields.

Reporting behind it

Related detections9 linkedT1190 — drag to rearrange

Malicious Web Shell Written to SharePoint LAYOUTS Directory by Worker Process (via file_event)

Malicious Command Shell Spawned by SQL Server via Process Creation (via process_creation)

Possible GoAnywhere MFT Exploitation via Tomcat Spawning Discovery Commands

Suspicious Command Shell Spawned by MSSQL Server Process Indicating Webshell

Malicious MOVEit Transfer Exploitation via X-siLock HTTP Headers (via webserver)

Malicious IIS w3wp Worker Spawning Command Interpreter via SharePoint Web Shell

Suspicious Single-Character Named Executable Launched by Web Server Process (via process_creation)

Malicious MOVEit human2.aspx Web Shell Dropped in wwwroot (via file_event)

Malicious IIS Worker Process Spawning PowerShell via Gladinet CentreStack Exploit

Windows Suspicious File Write to Apache/Tomcat webapps ROOT (.jsp) by Web Server Processes

Pivot detection · T1190 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-suspicious-file-write-to-apache-tomcat-webapps-root-as-jsp-from-dotnet-j-89c42960

title: Windows Suspicious File Write to Apache/Tomcat webapps ROOT (.jsp) by Web Server Processes
id: 982af81c-024d-48ae-9818-4fe342cd7480
status: experimental
description: This rule flags file creation or modification events where the target path is the webapps ROOT directory and the written file ends with .jsp. It focuses on activity where the originating process image name is dotnet.exe, w3wp.exe (IIS worker), or java.exe, and where the filename path contains apache or tomcat. Such behavior can indicate an attacker attempting to deploy unauthorized server-side scripts (e.g., web shells). Telemetry required includes Windows file event data with process image and target filename/path fields.
references:
  - https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_file_write_in_webapps_root.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-10-20
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.initial-access
  - attack.t1190
logsource:
  product: windows
  category: file_event
detection:
  selection_susp_img:
    Image|endswith:
      - \dotnet.exe
      - \w3wp.exe
      - \java.exe
  selection_servers:
    TargetFilename|contains:
      - \apache
      - \tomcat
  selection_path:
    TargetFilename|contains: \webapps\ROOT\
  selection_susp_extensions:
    TargetFilename|endswith: .jsp
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 89c42960-f244-4dad-9151-ae9b1a3287a2
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL