Suspicious Microsoft IIS Child Process

[rule]
description = """
Identifies the creation of a Microsoft IIS Worker child process with an unusual call stack. This may indicate successful
execution via an IIS exploit or webshell activity.
"""
id = "69819042-5436-48b6-a65f-be1f5920c52e"
license = "Elastic License v2"
name = "Suspicious Microsoft IIS Child Process"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/siestagraph-new-implant-uncovered-in-asean-member-foreign-ministry",
]
version = "1.0.2"

query = '''
process where event.action == "start" and process.parent.name : "w3wp.exe" and 
process.parent.thread.Ext.call_stack_summary == "ntdll.dll|kernelbase.dll|kernel32.dll|windows.storage.dll|shell32.dll|shcore.dll|kernel32.dll|ntdll.dll" and 
not (process.parent.args : "PrintService" and process.code_signature.exists == false) and 
not (process.code_signature.subject_name == "Hercules Social Housing B.V." and process.code_signature.trusted == true)
'''

min_endpoint_version = "8.10.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1190"
name = "Exploit Public-Facing Application"
reference = "https://attack.mitre.org/techniques/T1190/"


[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[internal]
min_endpoint_version = "8.10.0"