Windows webserver-spawned recon commands probing scripting tool help (perl/python/wget)

title: Windows webserver-spawned recon commands probing scripting tool help (perl/python/wget)
id: 81d8b2a1-b575-4f63-96d6-6fd7195e8b05
status: test
description: This rule identifies Windows processes launched from common web server executables (e.g., Caddy, nginx/httpd, php-cgi, IIS w3wp, Tomcat-related services) that execute command lines containing help probes for scripting and download tools. Such reconnaissance is commonly used by webshells to determine what utilities are available for follow-on activity. It relies on process creation telemetry, matching the parent web server process and the presence of specific "--help" or "-h" arguments in the child command line.
references:
  - https://ragged-lab.blogspot.com/2020/07/webshells-automating-reconnaissance.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_webshell_tool_recon.yml
author: Cian Heasley, Florian Roth (Nextron Systems), Huntrule Team
date: 2020-07-22
modified: 2023-11-09
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_webserver_image:
    ParentImage|endswith:
      - \caddy.exe
      - \httpd.exe
      - \nginx.exe
      - \php-cgi.exe
      - \w3wp.exe
      - \ws_tomcatservice.exe
  selection_webserver_characteristics_tomcat1:
    ParentImage|endswith:
      - \java.exe
      - \javaw.exe
    ParentImage|contains:
      - -tomcat-
      - \tomcat
  selection_webserver_characteristics_tomcat2:
    ParentImage|endswith:
      - \java.exe
      - \javaw.exe
    CommandLine|contains:
      - CATALINA_HOME
      - catalina.jar
  selection_recon:
    CommandLine|contains:
      - perl --help
      - perl -h
      - python --help
      - python -h
      - python3 --help
      - python3 -h
      - wget --help
  condition: 1 of selection_webserver_* and selection_recon
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: f64e5c19-879c-4bae-b471-6d84c8339677
    type: derived