cscli scenarios install sigmahq/proc_creation_win_webshell_tool_recon1type: trigger2name: sigmahq/proc_creation_win_webshell_tool_recon3description: |4 Detects processes spawned from web servers (PHP, Tomcat, IIS, etc.) that perform reconnaissance looking for the existence of popular scripting tools (perl, python, wget) on the system via the help commands5filter: |6 (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && ((evt.Parsed.ParentImage endsWith '\\caddy.exe' || evt.Parsed.ParentImage endsWith '\\httpd.exe' || evt.Parsed.ParentImage endsWith '\\nginx.exe' || evt.Parsed.ParentImage endsWith '\\php-cgi.exe' || evt.Parsed.ParentImage endsWith '\\w3wp.exe' || evt.Parsed.ParentImage endsWith '\\ws_tomcatservice.exe' || (evt.Parsed.ParentImage endsWith '\\java.exe' || evt.Parsed.ParentImage endsWith '\\javaw.exe') && (evt.Parsed.ParentImage contains '-tomcat-' || evt.Parsed.ParentImage contains '\\tomcat') || (evt.Parsed.ParentImage endsWith '\\java.exe' || evt.Parsed.ParentImage endsWith '\\javaw.exe') && (evt.Parsed.CommandLine contains 'CATALINA_HOME' || evt.Parsed.CommandLine contains 'catalina.jar')) && (evt.Parsed.CommandLine contains 'perl --help' || evt.Parsed.CommandLine contains 'perl -h' || evt.Parsed.CommandLine contains 'python --help' || evt.Parsed.CommandLine contains 'python -h' || evt.Parsed.CommandLine contains 'python3 --help' || evt.Parsed.CommandLine contains 'python3 -h' || evt.Parsed.CommandLine contains 'wget --help'))7blackhole: 2m8#status: test9labels:10 service: windows11 confidence: 112 spoofable: 013 classification:14 - attack.t1505.0031516 label: "Webshell Tool Reconnaissance Activity"17 behavior : "windows:audit"18 remediation: false1920scope:21 type: ParentProcessId22 expression: evt.Parsed.ParentProcessId2324