Windows Suspicious File Write to Apache/Tomcat webapps ROOT (.jsp) by Web Server Processes
Alerts on .jsp writes into Apache/Tomcat webapps ROOT from dotnet/java/IIS worker processes on Windows.
- Product
- windows
- Category
- file_event
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2025-10-20
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → PersistenceRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags file creation or modification events where the target path is the webapps ROOT directory and the written file ends with .jsp. It focuses on activity where the originating process image name is dotnet.exe, w3wp.exe (IIS worker), or java.exe, and where the filename path contains apache or tomcat. Such behavior can indicate an attacker attempting to deploy unauthorized server-side scripts (e.g., web shells). Telemetry required includes Windows file event data with process image and target filename/path fields.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Suspicious File Write to Apache/Tomcat webapps ROOT (.jsp) by Web Server Processes
id: 982af81c-024d-48ae-9818-4fe342cd7480
status: experimental
description: This rule flags file creation or modification events where the target path is the webapps ROOT directory and the written file ends with .jsp. It focuses on activity where the originating process image name is dotnet.exe, w3wp.exe (IIS worker), or java.exe, and where the filename path contains apache or tomcat. Such behavior can indicate an attacker attempting to deploy unauthorized server-side scripts (e.g., web shells). Telemetry required includes Windows file event data with process image and target filename/path fields.
references:
- https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_file_write_in_webapps_root.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-10-20
tags:
- attack.persistence
- attack.t1505.003
- attack.initial-access
- attack.t1190
logsource:
product: windows
category: file_event
detection:
selection_susp_img:
Image|endswith:
- \dotnet.exe
- \w3wp.exe
- \java.exe
selection_servers:
TargetFilename|contains:
- \apache
- \tomcat
selection_path:
TargetFilename|contains: \webapps\ROOT\
selection_susp_extensions:
TargetFilename|endswith: .jsp
condition: all of selection_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 89c42960-f244-4dad-9151-ae9b1a3287a2
type: derived