Windows Webserver Parent Process Launching Credential Dumping and Exfiltration Commands
Flags web server processes spawning child commands consistent with credential dumping, exfiltration, and privilege changes.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-03-17
- Updated
- 2026-07-30
ATT&CK techniques
Persistence → DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows process creation events where a common web server parent process (Caddy, Apache httpd, Nginx, php-cgi, IIS w3wp, or Tomcat Java) spawns a child process whose command line matches patterns used for credential dumping, archive-based exfiltration, local administrator changes, or AD/service reconnaissance. This matters because attackers commonly use web shells under web-facing processes to blend malicious activity with legitimate server execution. The detection relies on Windows process creation telemetry, specifically the parent image, child image, and command-line substrings captured in event logs.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Webserver Parent Process Launching Credential Dumping and Exfiltration Commands
id: f8019742-c481-4f11-ad1e-70c1b0275f90
status: test
description: This rule identifies Windows process creation events where a common web server parent process (Caddy, Apache httpd, Nginx, php-cgi, IIS w3wp, or Tomcat Java) spawns a child process whose command line matches patterns used for credential dumping, archive-based exfiltration, local administrator changes, or AD/service reconnaissance. This matters because attackers commonly use web shells under web-facing processes to blend malicious activity with legitimate server execution. The detection relies on Windows process creation telemetry, specifically the parent image, child image, and command-line substrings captured in event logs.
references:
- https://youtu.be/7aemGhaE9ds?t=641
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_webshell_hacking.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-03-17
modified: 2023-11-09
tags:
- attack.persistence
- attack.discovery
- attack.t1505.003
- attack.t1018
- attack.t1033
- attack.t1087
logsource:
category: process_creation
product: windows
detection:
selection_webserver_image:
ParentImage|endswith:
- \caddy.exe
- \httpd.exe
- \nginx.exe
- \php-cgi.exe
- \w3wp.exe
- \ws_tomcatservice.exe
selection_webserver_characteristics_tomcat1:
ParentImage|endswith:
- \java.exe
- \javaw.exe
ParentImage|contains:
- -tomcat-
- \tomcat
selection_webserver_characteristics_tomcat2:
ParentImage|endswith:
- \java.exe
- \javaw.exe
CommandLine|contains:
- catalina.jar
- CATALINA_HOME
selection_child_1:
CommandLine|contains|all:
- rundll32
- comsvcs
selection_child_2:
CommandLine|contains|all:
- " -hp"
- " a "
- " -m"
selection_child_3:
CommandLine|contains|all:
- net
- " user "
- " /add"
selection_child_4:
CommandLine|contains|all:
- net
- " localgroup "
- " administrators "
- /add
selection_child_5:
Image|endswith:
- \ntdsutil.exe
- \ldifde.exe
- \adfind.exe
- \procdump.exe
- \Nanodump.exe
- \vssadmin.exe
- \fsutil.exe
selection_child_6:
CommandLine|contains:
- " -decode "
- " -NoP "
- " -W Hidden "
- " /decode "
- " /ticket:"
- " sekurlsa"
- .dmp full
- .downloadfile(
- .downloadstring(
- FromBase64String
- process call create
- "reg save "
- whoami /priv
condition: 1 of selection_webserver_* and 1 of selection_child_*
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 4ebc877f-4612-45cb-b3a5-8e3834db36c9
type: derived