Windows Webshell Recon Command-Line Keywords via Web Server Processes

title: Windows Webshell Recon Command-Line Keywords via Web Server Processes
id: 4248c1e3-b207-46d0-8326-e2c2da095301
status: test
description: This rule identifies process creation on Windows where a web server parent process (e.g., w3wp.exe, php-cgi.exe, nginx.exe) is followed by command-line activity containing specific reconnaissance and execution patterns. Attackers commonly use webshells to run additional discovery commands and download or execute payloads, so the command-line keywords and suspicious child processes provide key behavioral signals. The detection relies on process creation telemetry with ParentImage/Image/OriginalFileName and CommandLine fields to match both the hosting context and the follow-on reconnaissance indicators.
references:
  - https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-ii.html
  - https://unit42.paloaltonetworks.com/bumblebee-webshell-xhunt-campaign/
  - https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_webshell_recon_commands_and_processes.yml
author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson, Huntrule Team
date: 2017-01-01
modified: 2026-07-14
tags:
  - attack.persistence
  - attack.discovery
  - attack.t1505.003
  - attack.t1018
  - attack.t1033
  - attack.t1087
logsource:
  category: process_creation
  product: windows
detection:
  selection_webserver_image:
    ParentImage|endswith:
      - \w3wp.exe
      - \php-cgi.exe
      - \nginx.exe
      - \httpd.exe
      - \caddy.exe
      - \ws_tomcatservice.exe
  selection_webserver_characteristics_tomcat1:
    ParentImage|endswith:
      - \java.exe
      - \javaw.exe
    ParentImage|contains:
      - -tomcat-
      - \tomcat
  selection_webserver_characteristics_tomcat2:
    ParentImage|endswith:
      - \java.exe
      - \javaw.exe
    CommandLine|contains:
      - catalina.jar
      - CATALINA_HOME
  selection_susp_net_utility:
    OriginalFileName:
      - net.exe
      - net1.exe
    CommandLine|contains:
      - " user "
      - " use "
      - " group "
  selection_susp_ping_utility:
    OriginalFileName: ping.exe
    CommandLine|contains: " -n "
  selection_susp_change_dir:
    CommandLine|contains:
      - "&cd&echo"
      - "cd /d "
  selection_susp_wmic_utility:
    OriginalFileName: wmic.exe
    CommandLine|contains: " /node:"
  selection_susp_powershell_cli:
    Image|endswith:
      - \cmd.exe
      - \powershell.exe
      - \pwsh.exe
    CommandLine|contains:
      - " -enc "
      - " -EncodedCommand "
      - " -w hidden "
      - " -windowstyle hidden"
      - .WebClient).Download
  selection_susp_misc_discovery_binaries:
    - Image|endswith:
        - \dsquery.exe
        - \find.exe
        - \findstr.exe
        - \ipconfig.exe
        - \netstat.exe
        - \nslookup.exe
        - \pathping.exe
        - \quser.exe
        - \schtasks.exe
        - \systeminfo.exe
        - \tasklist.exe
        - \tracert.exe
        - \wevtutil.exe
        - \whoami.exe
    - OriginalFileName:
        - dsquery.exe
        - find.exe
        - findstr.exe
        - ipconfig.exe
        - netstat.exe
        - nslookup.exe
        - pathping.exe
        - quser.exe
        - schtasks.exe
        - sysinfo.exe
        - tasklist.exe
        - tracert.exe
        - VSSADMIN.EXE
        - wevtutil.exe
        - whoami.exe
  selection_susp_misc_discovery_commands:
    CommandLine|contains:
      - " Test-NetConnection "
      - dir \
  condition: 1 of selection_webserver_* and 1 of selection_susp_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: bed2a484-9348-4143-8a8a-b801c979301c
    type: derived