Windows webserver-spawned recon commands probing scripting tool help (perl/python/wget)
Flags webserver child processes running perl/python/python3/wget help commands to probe available tooling on the host.
- Product
- windows
- Category
- process_creation
- Author
- Cian Heasley, Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2020-07-22
- Updated
- 2026-07-30
ATT&CK techniques
PersistenceRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows processes launched from common web server executables (e.g., Caddy, nginx/httpd, php-cgi, IIS w3wp, Tomcat-related services) that execute command lines containing help probes for scripting and download tools. Such reconnaissance is commonly used by webshells to determine what utilities are available for follow-on activity. It relies on process creation telemetry, matching the parent web server process and the presence of specific "--help" or "-h" arguments in the child command line.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows webserver-spawned recon commands probing scripting tool help (perl/python/wget)
id: 81d8b2a1-b575-4f63-96d6-6fd7195e8b05
status: test
description: This rule identifies Windows processes launched from common web server executables (e.g., Caddy, nginx/httpd, php-cgi, IIS w3wp, Tomcat-related services) that execute command lines containing help probes for scripting and download tools. Such reconnaissance is commonly used by webshells to determine what utilities are available for follow-on activity. It relies on process creation telemetry, matching the parent web server process and the presence of specific "--help" or "-h" arguments in the child command line.
references:
- https://ragged-lab.blogspot.com/2020/07/webshells-automating-reconnaissance.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_webshell_tool_recon.yml
author: Cian Heasley, Florian Roth (Nextron Systems), Huntrule Team
date: 2020-07-22
modified: 2023-11-09
tags:
- attack.persistence
- attack.t1505.003
logsource:
category: process_creation
product: windows
detection:
selection_webserver_image:
ParentImage|endswith:
- \caddy.exe
- \httpd.exe
- \nginx.exe
- \php-cgi.exe
- \w3wp.exe
- \ws_tomcatservice.exe
selection_webserver_characteristics_tomcat1:
ParentImage|endswith:
- \java.exe
- \javaw.exe
ParentImage|contains:
- -tomcat-
- \tomcat
selection_webserver_characteristics_tomcat2:
ParentImage|endswith:
- \java.exe
- \javaw.exe
CommandLine|contains:
- CATALINA_HOME
- catalina.jar
selection_recon:
CommandLine|contains:
- perl --help
- perl -h
- python --help
- python -h
- python3 --help
- python3 -h
- wget --help
condition: 1 of selection_webserver_* and selection_recon
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: f64e5c19-879c-4bae-b471-6d84c8339677
type: derived