Windows Webshell Recon Command-Line Keywords via Web Server Processes
Flags Windows process chains where web server parents spawn reconnaissance- and execution-related command lines indicative of webshell activity.
FreeReviewedSigma · High · v1
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson (SigmaHQ), DRL 1.1
- Published
- 2017-01-01
- Updated
- 2026-07-30
ATT&CK techniques
Persistence → DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process creation on Windows where a web server parent process (e.g., w3wp.exe, php-cgi.exe, nginx.exe) is followed by command-line activity containing specific reconnaissance and execution patterns. Attackers commonly use webshells to run additional discovery commands and download or execute payloads, so the command-line keywords and suspicious child processes provide key behavioral signals. The detection relies on process creation telemetry with ParentImage/Image/OriginalFileName and CommandLine fields to match both the hosting context and the follow-on reconnaissance indicators.
Reporting behind it
- fireeye.comhttps://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-ii.html
- unit42.paloaltonetworks.comhttps://unit42.paloaltonetworks.com/bumblebee-webshell-xhunt-campaign/
- huntress.comhttps://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_webshell_recon_commands_and_processes.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-webshell-recon-command-line-keywords-via-web-server-processes-bed2a484
title: Windows Webshell Recon Command-Line Keywords via Web Server Processes
id: 4248c1e3-b207-46d0-8326-e2c2da095301
status: test
description: This rule identifies process creation on Windows where a web server parent process (e.g., w3wp.exe, php-cgi.exe, nginx.exe) is followed by command-line activity containing specific reconnaissance and execution patterns. Attackers commonly use webshells to run additional discovery commands and download or execute payloads, so the command-line keywords and suspicious child processes provide key behavioral signals. The detection relies on process creation telemetry with ParentImage/Image/OriginalFileName and CommandLine fields to match both the hosting context and the follow-on reconnaissance indicators.
references:
- https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-ii.html
- https://unit42.paloaltonetworks.com/bumblebee-webshell-xhunt-campaign/
- https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_webshell_recon_commands_and_processes.yml
author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson, Huntrule Team
date: 2017-01-01
modified: 2026-07-14
tags:
- attack.persistence
- attack.discovery
- attack.t1505.003
- attack.t1018
- attack.t1033
- attack.t1087
logsource:
category: process_creation
product: windows
detection:
selection_webserver_image:
ParentImage|endswith:
- \w3wp.exe
- \php-cgi.exe
- \nginx.exe
- \httpd.exe
- \caddy.exe
- \ws_tomcatservice.exe
selection_webserver_characteristics_tomcat1:
ParentImage|endswith:
- \java.exe
- \javaw.exe
ParentImage|contains:
- -tomcat-
- \tomcat
selection_webserver_characteristics_tomcat2:
ParentImage|endswith:
- \java.exe
- \javaw.exe
CommandLine|contains:
- catalina.jar
- CATALINA_HOME
selection_susp_net_utility:
OriginalFileName:
- net.exe
- net1.exe
CommandLine|contains:
- " user "
- " use "
- " group "
selection_susp_ping_utility:
OriginalFileName: ping.exe
CommandLine|contains: " -n "
selection_susp_change_dir:
CommandLine|contains:
- "&cd&echo"
- "cd /d "
selection_susp_wmic_utility:
OriginalFileName: wmic.exe
CommandLine|contains: " /node:"
selection_susp_powershell_cli:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
CommandLine|contains:
- " -enc "
- " -EncodedCommand "
- " -w hidden "
- " -windowstyle hidden"
- .WebClient).Download
selection_susp_misc_discovery_binaries:
- Image|endswith:
- \dsquery.exe
- \find.exe
- \findstr.exe
- \ipconfig.exe
- \netstat.exe
- \nslookup.exe
- \pathping.exe
- \quser.exe
- \schtasks.exe
- \systeminfo.exe
- \tasklist.exe
- \tracert.exe
- \wevtutil.exe
- \whoami.exe
- OriginalFileName:
- dsquery.exe
- find.exe
- findstr.exe
- ipconfig.exe
- netstat.exe
- nslookup.exe
- pathping.exe
- quser.exe
- schtasks.exe
- sysinfo.exe
- tasklist.exe
- tracert.exe
- VSSADMIN.EXE
- wevtutil.exe
- whoami.exe
selection_susp_misc_discovery_commands:
CommandLine|contains:
- " Test-NetConnection "
- dir \
condition: 1 of selection_webserver_* and 1 of selection_susp_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: bed2a484-9348-4143-8a8a-b801c979301c
type: derived