cscli scenarios install sigmahq/proc_creation_win_webshell_susp_process_spawned_from_webserver1type: trigger2name: sigmahq/proc_creation_win_webshell_susp_process_spawned_from_webserver3description: |4 Detects potentially suspicious processes being spawned by a web server process which could be the result of a successfully placed web shell or exploitation5filter: |6 (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && ((evt.Parsed.ParentImage endsWith '\\caddy.exe' || evt.Parsed.ParentImage endsWith '\\httpd.exe' || evt.Parsed.ParentImage endsWith '\\nginx.exe' || evt.Parsed.ParentImage endsWith '\\php-cgi.exe' || evt.Parsed.ParentImage endsWith '\\php.exe' || evt.Parsed.ParentImage endsWith '\\tomcat.exe' || evt.Parsed.ParentImage endsWith '\\UMWorkerProcess.exe' || evt.Parsed.ParentImage endsWith '\\w3wp.exe' || evt.Parsed.ParentImage endsWith '\\ws_TomcatService.exe' || (evt.Parsed.ParentImage endsWith '\\java.exe' || evt.Parsed.ParentImage endsWith '\\javaw.exe') && (evt.Parsed.ParentImage contains '-tomcat-' || evt.Parsed.ParentImage contains '\\tomcat') || (evt.Parsed.ParentImage endsWith '\\java.exe' || evt.Parsed.ParentImage endsWith '\\javaw.exe') && (evt.Parsed.ParentCommandLine contains 'CATALINA_HOME' || evt.Parsed.ParentCommandLine contains 'catalina.home' || evt.Parsed.ParentCommandLine contains 'catalina.jar')) && (evt.Parsed.Image endsWith '\\arp.exe' || evt.Parsed.Image endsWith '\\at.exe' || evt.Parsed.Image endsWith '\\bash.exe' || evt.Parsed.Image endsWith '\\bitsadmin.exe' || evt.Parsed.Image endsWith '\\certutil.exe' || evt.Parsed.Image endsWith '\\cmd.exe' || evt.Parsed.Image endsWith '\\cscript.exe' || evt.Parsed.Image endsWith '\\dsget.exe' || evt.Parsed.Image endsWith '\\hostname.exe' || evt.Parsed.Image endsWith '\\nbtstat.exe' || evt.Parsed.Image endsWith '\\net.exe' || evt.Parsed.Image endsWith '\\net1.exe' || evt.Parsed.Image endsWith '\\netdom.exe' || evt.Parsed.Image endsWith '\\netsh.exe' || evt.Parsed.Image endsWith '\\nltest.exe' || evt.Parsed.Image endsWith '\\ntdutil.exe' || evt.Parsed.Image endsWith '\\powershell_ise.exe' || evt.Parsed.Image endsWith '\\powershell.exe' || evt.Parsed.Image endsWith '\\pwsh.exe' || evt.Parsed.Image endsWith '\\qprocess.exe' || evt.Parsed.Image endsWith '\\query.exe' || evt.Parsed.Image endsWith '\\qwinsta.exe' || evt.Parsed.Image endsWith '\\reg.exe' || evt.Parsed.Image endsWith '\\rundll32.exe' || evt.Parsed.Image endsWith '\\sc.exe' || evt.Parsed.Image endsWith '\\sh.exe' || evt.Parsed.Image endsWith '\\wmic.exe' || evt.Parsed.Image endsWith '\\wscript.exe' || evt.Parsed.Image endsWith '\\wusa.exe') && not (evt.Parsed.ParentImage endsWith '\\java.exe' && evt.Parsed.CommandLine endsWith 'Windows\\system32\\cmd.exe /c C:\\ManageEngine\\ADManager "Plus\\ES\\bin\\elasticsearch.bat -Enode.name=RMP-NODE1 -pelasticsearch-pid.txt' || evt.Parsed.ParentImage endsWith '\\java.exe' && evt.Parsed.CommandLine contains 'sc query' && evt.Parsed.CommandLine contains 'ADManager Plus'))7blackhole: 2m8#status: test9labels:10 service: windows11 confidence: 112 spoofable: 013 classification:14 - attack.t1505.00315 - attack.t11901617 label: "Suspicious Process By Web Server Process"18 behavior : "windows:audit"19 remediation: false2021scope:22 type: ParentProcessId23 expression: evt.Parsed.ParentProcessId2425