detection.wiki

Detection rules › Sigma

Suspicious File Write to Webapps Root Directory

Status
experimental
Severity
medium
Log source
product windows, category file_event
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects suspicious file writes to the root directory of web applications, particularly Apache web servers or Tomcat servers. This may indicate an attempt to deploy malicious files such as web shells or other unauthorized scripts.

MITRE ATT&CK coverage

TacticTechniques
Initial AccessT1190 Exploit Public-Facing Application
PersistenceT1505.003 Server Software Component: Web Shell

Event coverage

ProviderEventTitle
SysmonEvent ID 11FileCreate

Rule body yaml

title: Suspicious File Write to Webapps Root Directory
id: 89c42960-f244-4dad-9151-ae9b1a3287a2
status: experimental
description: |
    Detects suspicious file writes to the root directory of web applications, particularly Apache web servers or Tomcat servers.
    This may indicate an attempt to deploy malicious files such as web shells or other unauthorized scripts.
references:
    - https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-10-20
tags:
    - attack.persistence
    - attack.t1505.003
    - attack.initial-access
    - attack.t1190
logsource:
    product: windows
    category: file_event
detection:
    # Add more suspicious processes or paths or extensions as needed
    selection_susp_img:
        Image|endswith:
            - '\dotnet.exe'
            - '\w3wp.exe'
            - '\java.exe'
    selection_servers:
        TargetFilename|contains:
            - '\apache'
            - '\tomcat'
    selection_path:
        TargetFilename|contains: '\webapps\ROOT\'
    selection_susp_extensions:
        TargetFilename|endswith: '.jsp'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: condition

all of selection_*

Stage 1: selection_susp_img

selection_susp_img:
    Image|endswith:
        - '\dotnet.exe'
        - '\w3wp.exe'
        - '\java.exe'

Stage 2: selection_servers

selection_servers:
    TargetFilename|contains:
        - '\apache'
        - '\tomcat'

Stage 3: selection_path

selection_path:
    TargetFilename|contains: '\webapps\ROOT\'

Stage 4: selection_susp_extensions

selection_susp_extensions:
    TargetFilename|endswith: '.jsp'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Imageends_with
  • \dotnet.exe corpus 2 (sigma 2)
  • \java.exe
  • \w3wp.exe corpus 6 (sigma 6)
TargetFilenameends_with
  • .jsp corpus 5 (sigma 4, splunk 1)
TargetFilenamematch
  • \apache
  • \tomcat corpus 2 (sigma 2)
  • \webapps\ROOT\