Windows Webserver Parent Process Launching Credential Dumping and Exfiltration Commands

title: Windows Webserver Parent Process Launching Credential Dumping and Exfiltration Commands
id: f8019742-c481-4f11-ad1e-70c1b0275f90
status: test
description: This rule identifies Windows process creation events where a common web server parent process (Caddy, Apache httpd, Nginx, php-cgi, IIS w3wp, or Tomcat Java) spawns a child process whose command line matches patterns used for credential dumping, archive-based exfiltration, local administrator changes, or AD/service reconnaissance. This matters because attackers commonly use web shells under web-facing processes to blend malicious activity with legitimate server execution. The detection relies on Windows process creation telemetry, specifically the parent image, child image, and command-line substrings captured in event logs.
references:
  - https://youtu.be/7aemGhaE9ds?t=641
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_webshell_hacking.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-03-17
modified: 2023-11-09
tags:
  - attack.persistence
  - attack.discovery
  - attack.t1505.003
  - attack.t1018
  - attack.t1033
  - attack.t1087
logsource:
  category: process_creation
  product: windows
detection:
  selection_webserver_image:
    ParentImage|endswith:
      - \caddy.exe
      - \httpd.exe
      - \nginx.exe
      - \php-cgi.exe
      - \w3wp.exe
      - \ws_tomcatservice.exe
  selection_webserver_characteristics_tomcat1:
    ParentImage|endswith:
      - \java.exe
      - \javaw.exe
    ParentImage|contains:
      - -tomcat-
      - \tomcat
  selection_webserver_characteristics_tomcat2:
    ParentImage|endswith:
      - \java.exe
      - \javaw.exe
    CommandLine|contains:
      - catalina.jar
      - CATALINA_HOME
  selection_child_1:
    CommandLine|contains|all:
      - rundll32
      - comsvcs
  selection_child_2:
    CommandLine|contains|all:
      - " -hp"
      - " a "
      - " -m"
  selection_child_3:
    CommandLine|contains|all:
      - net
      - " user "
      - " /add"
  selection_child_4:
    CommandLine|contains|all:
      - net
      - " localgroup "
      - " administrators "
      - /add
  selection_child_5:
    Image|endswith:
      - \ntdsutil.exe
      - \ldifde.exe
      - \adfind.exe
      - \procdump.exe
      - \Nanodump.exe
      - \vssadmin.exe
      - \fsutil.exe
  selection_child_6:
    CommandLine|contains:
      - " -decode "
      - " -NoP "
      - " -W Hidden "
      - " /decode "
      - " /ticket:"
      - " sekurlsa"
      - .dmp full
      - .downloadfile(
      - .downloadstring(
      - FromBase64String
      - process call create
      - "reg save "
      - whoami /priv
  condition: 1 of selection_webserver_* and 1 of selection_child_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 4ebc877f-4612-45cb-b3a5-8e3834db36c9
    type: derived