Windows Webserver Parent Process Launching Credential Dumping and Exfiltration Commands

Flags web server processes spawning child commands consistent with credential dumping, exfiltration, and privilege changes.

FreeReviewedSigma · High · v1

Product: windows
Category: process_creation
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2022-03-17
Updated: 2026-07-30

Analysis Detection

ATT&CK techniques

Persistence → Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1505.003Web Shell
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Windows process creation events where a common web server parent process (Caddy, Apache httpd, Nginx, php-cgi, IIS w3wp, or Tomcat Java) spawns a child process whose command line matches patterns used for credential dumping, archive-based exfiltration, local administrator changes, or AD/service reconnaissance. This matters because attackers commonly use web shells under web-facing processes to blend malicious activity with legitimate server execution. The detection relies on Windows process creation telemetry, specifically the parent image, child image, and command-line substrings captured in event logs.

Reporting behind it

Related detections9 linkedT1505.003 — drag to rearrange

Windows Process Creation: China Chopper Webshell Command Pattern via W3WP

Windows Webshell Recon Command-Line Keywords via Web Server Processes

Suspicious IIS Worker Process Spawning Whoami Reconnaissance

Suspicious SimpleHelp Remote Access Client Spawning Discovery Commands (via process_creation)

Cisco AAA discovery via show/dir commands

Suspicious Weaver Ant In-Memory Web Shell Marker in Web Request (via webserver)

Malicious Web Server Process Spawning Command Interpreter via Web Shell (via process_creation)

Malicious Web Shell Written to SharePoint LAYOUTS Directory by Worker Process (via file_event)

Malicious IIS Worker Process Spawning Command Shell for Webshell Reconnaissance (via process_creation)

Windows Webserver Parent Process Launching Credential Dumping and Exfiltration Commands

Pivot detection · T1505.003 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-webserver-parent-process-launching-credential-dumping-and-exfiltration-c-4ebc877f

title: Windows Webserver Parent Process Launching Credential Dumping and Exfiltration Commands
id: f8019742-c481-4f11-ad1e-70c1b0275f90
status: test
description: This rule identifies Windows process creation events where a common web server parent process (Caddy, Apache httpd, Nginx, php-cgi, IIS w3wp, or Tomcat Java) spawns a child process whose command line matches patterns used for credential dumping, archive-based exfiltration, local administrator changes, or AD/service reconnaissance. This matters because attackers commonly use web shells under web-facing processes to blend malicious activity with legitimate server execution. The detection relies on Windows process creation telemetry, specifically the parent image, child image, and command-line substrings captured in event logs.
references:
  - https://youtu.be/7aemGhaE9ds?t=641
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_webshell_hacking.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-03-17
modified: 2023-11-09
tags:
  - attack.persistence
  - attack.discovery
  - attack.t1505.003
  - attack.t1018
  - attack.t1033
  - attack.t1087
logsource:
  category: process_creation
  product: windows
detection:
  selection_webserver_image:
    ParentImage|endswith:
      - \caddy.exe
      - \httpd.exe
      - \nginx.exe
      - \php-cgi.exe
      - \w3wp.exe
      - \ws_tomcatservice.exe
  selection_webserver_characteristics_tomcat1:
    ParentImage|endswith:
      - \java.exe
      - \javaw.exe
    ParentImage|contains:
      - -tomcat-
      - \tomcat
  selection_webserver_characteristics_tomcat2:
    ParentImage|endswith:
      - \java.exe
      - \javaw.exe
    CommandLine|contains:
      - catalina.jar
      - CATALINA_HOME
  selection_child_1:
    CommandLine|contains|all:
      - rundll32
      - comsvcs
  selection_child_2:
    CommandLine|contains|all:
      - " -hp"
      - " a "
      - " -m"
  selection_child_3:
    CommandLine|contains|all:
      - net
      - " user "
      - " /add"
  selection_child_4:
    CommandLine|contains|all:
      - net
      - " localgroup "
      - " administrators "
      - /add
  selection_child_5:
    Image|endswith:
      - \ntdsutil.exe
      - \ldifde.exe
      - \adfind.exe
      - \procdump.exe
      - \Nanodump.exe
      - \vssadmin.exe
      - \fsutil.exe
  selection_child_6:
    CommandLine|contains:
      - " -decode "
      - " -NoP "
      - " -W Hidden "
      - " /decode "
      - " /ticket:"
      - " sekurlsa"
      - .dmp full
      - .downloadfile(
      - .downloadstring(
      - FromBase64String
      - process call create
      - "reg save "
      - whoami /priv
  condition: 1 of selection_webserver_* and 1 of selection_child_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 4ebc877f-4612-45cb-b3a5-8e3834db36c9
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL