Windows Suspicious File Write to Apache/Tomcat Webapps ROOT as .jsp from dotnet/java/w3wp

title: Windows Suspicious File Write to Apache/Tomcat Webapps ROOT as .jsp from dotnet/java/w3wp
id: 982af81c-024d-48ae-9818-4fe342cd7480
status: experimental
description: This rule flags file creation or modification events where the target path is within a web application ROOT directory and the file ends with .jsp. It focuses on cases where the writing process is dotnet.exe, w3wp.exe, or java.exe and the target filename path indicates Apache or Tomcat. Such activity can be a sign of attacker persistence by deploying unauthorized web-executable scripts, and it relies on Windows file event telemetry capturing the process image name and target filename/path.
references:
  - https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_file_write_in_webapps_root.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-10-20
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.initial-access
  - attack.t1190
logsource:
  product: windows
  category: file_event
detection:
  selection_susp_img:
    Image|endswith:
      - \dotnet.exe
      - \w3wp.exe
      - \java.exe
  selection_servers:
    TargetFilename|contains:
      - \apache
      - \tomcat
  selection_path:
    TargetFilename|contains: \webapps\ROOT\
  selection_susp_extensions:
    TargetFilename|endswith: .jsp
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 89c42960-f244-4dad-9151-ae9b1a3287a2
    type: derived