1type: trigger
2name: sigmahq/proc_creation_win_webshell_chopper
3description: |
4  Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells
5filter: |
6  (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && ((evt.Parsed.Image endsWith '\\w3wp.exe' || evt.Parsed.ParentImage endsWith '\\w3wp.exe') && (evt.Parsed.CommandLine contains '&ipconfig&echo' || evt.Parsed.CommandLine contains '&quser&echo' || evt.Parsed.CommandLine contains '&whoami&echo' || evt.Parsed.CommandLine contains '&c:&echo' || evt.Parsed.CommandLine contains '&cd&echo' || evt.Parsed.CommandLine contains '&dir&echo' || evt.Parsed.CommandLine contains '&echo [E]' || evt.Parsed.CommandLine contains '&echo [S]'))
7blackhole: 2m
8#status: test
9labels:
10  service: windows
11  confidence: 1
12  spoofable: 0
13  classification:
14   - attack.t1505.003
15   - attack.t1018
16   - attack.t1033
17   - attack.t1087
18
19  label: "Chopper Webshell Process Pattern"
20  behavior : "windows:audit"
21  remediation: false
22
23scope:
24  type: ParentProcessId
25  expression: evt.Parsed.ParentProcessId
26
27