cscli scenarios install sigmahq/proc_creation_win_webshell_hacking1type: trigger2name: sigmahq/proc_creation_win_webshell_hacking3description: |4 Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system5filter: |6 (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && ((evt.Parsed.ParentImage endsWith '\\caddy.exe' || evt.Parsed.ParentImage endsWith '\\httpd.exe' || evt.Parsed.ParentImage endsWith '\\nginx.exe' || evt.Parsed.ParentImage endsWith '\\php-cgi.exe' || evt.Parsed.ParentImage endsWith '\\w3wp.exe' || evt.Parsed.ParentImage endsWith '\\ws_tomcatservice.exe' || (evt.Parsed.ParentImage endsWith '\\java.exe' || evt.Parsed.ParentImage endsWith '\\javaw.exe') && (evt.Parsed.ParentImage contains '-tomcat-' || evt.Parsed.ParentImage contains '\\tomcat') || (evt.Parsed.ParentImage endsWith '\\java.exe' || evt.Parsed.ParentImage endsWith '\\javaw.exe') && (evt.Parsed.CommandLine contains 'catalina.jar' || evt.Parsed.CommandLine contains 'CATALINA_HOME')) && (evt.Parsed.CommandLine contains 'rundll32' && evt.Parsed.CommandLine contains 'comsvcs' || evt.Parsed.CommandLine contains ' -hp' && evt.Parsed.CommandLine contains ' a ' && evt.Parsed.CommandLine contains ' -m' || evt.Parsed.CommandLine contains 'net' && evt.Parsed.CommandLine contains ' user ' && evt.Parsed.CommandLine contains ' /add' || evt.Parsed.CommandLine contains 'net' && evt.Parsed.CommandLine contains ' localgroup ' && evt.Parsed.CommandLine contains ' administrators ' && evt.Parsed.CommandLine contains '/add' || evt.Parsed.Image endsWith '\\ntdsutil.exe' || evt.Parsed.Image endsWith '\\ldifde.exe' || evt.Parsed.Image endsWith '\\adfind.exe' || evt.Parsed.Image endsWith '\\procdump.exe' || evt.Parsed.Image endsWith '\\Nanodump.exe' || evt.Parsed.Image endsWith '\\vssadmin.exe' || evt.Parsed.Image endsWith '\\fsutil.exe' || evt.Parsed.CommandLine contains ' -decode ' || evt.Parsed.CommandLine contains ' -NoP ' || evt.Parsed.CommandLine contains ' -W Hidden ' || evt.Parsed.CommandLine contains ' /decode ' || evt.Parsed.CommandLine contains ' /ticket:' || evt.Parsed.CommandLine contains ' sekurlsa' || evt.Parsed.CommandLine contains '.dmp full' || evt.Parsed.CommandLine contains '.downloadfile(' || evt.Parsed.CommandLine contains '.downloadstring(' || evt.Parsed.CommandLine contains 'FromBase64String' || evt.Parsed.CommandLine contains 'process call create' || evt.Parsed.CommandLine contains 'reg save ' || evt.Parsed.CommandLine contains 'whoami /priv'))7blackhole: 2m8#status: test9labels:10 service: windows11 confidence: 112 spoofable: 013 classification:14 - attack.t1505.00315 - attack.t101816 - attack.t103317 - attack.t10871819 label: "Webshell Hacking Activity Patterns"20 behavior : "windows:audit"21 remediation: false2223scope:24 type: ParentProcessId25 expression: evt.Parsed.ParentProcessId2627