cscli scenarios install sigmahq/proc_creation_win_webshell_chopper1type: trigger2name: sigmahq/proc_creation_win_webshell_chopper3description: |4 Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells5filter: |6 (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && ((evt.Parsed.Image endsWith '\\w3wp.exe' || evt.Parsed.ParentImage endsWith '\\w3wp.exe') && (evt.Parsed.CommandLine contains '&ipconfig&echo' || evt.Parsed.CommandLine contains '&quser&echo' || evt.Parsed.CommandLine contains '&whoami&echo' || evt.Parsed.CommandLine contains '&c:&echo' || evt.Parsed.CommandLine contains '&cd&echo' || evt.Parsed.CommandLine contains '&dir&echo' || evt.Parsed.CommandLine contains '&echo [E]' || evt.Parsed.CommandLine contains '&echo [S]'))7blackhole: 2m8#status: test9labels:10 service: windows11 confidence: 112 spoofable: 013 classification:14 - attack.t1505.00315 - attack.t101816 - attack.t103317 - attack.t10871819 label: "Chopper Webshell Process Pattern"20 behavior : "windows:audit"21 remediation: false2223scope:24 type: ParentProcessId25 expression: evt.Parsed.ParentProcessId2627