Execution From Webserver Root Folder

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: Florian Roth (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects a program executing from a web server root folder. Use this rule to hunt for potential interesting activity such as webshell or backdoors

Known false positives

Various applications
Tools that include ping or nslookup command invocations

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1505.003` Server Software Component: Web Shell

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: Execution From Webserver Root Folder
id: 35efb964-e6a5-47ad-bbcd-19661854018d
status: test
description: |
    Detects a program executing from a web server root folder. Use this rule to hunt for potential interesting activity such as webshell or backdoors
references:
    - Internal Research
author: Florian Roth (Nextron Systems)
date: 2019-01-16
modified: 2024-01-18
tags:
    - attack.persistence
    - attack.t1505.003
    - detection.threat-hunting
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|contains:
            - '\wwwroot\'
            - '\wmpub\'
            - '\htdocs\'
    filter_main_generic:
        Image|contains:
            - 'bin\'
            - '\Tools\'
            - '\SMSComponent\'
        ParentImage|endswith: '\services.exe'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Various applications
    - Tools that include ping or nslookup command invocations
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_main_*

Stage 1: `selection`

selection:
    Image|contains:
        - '\wwwroot\'
        - '\wmpub\'
        - '\htdocs\'

Stage 2: `not filter_main_generic`

filter_main_generic:
    Image|contains:
        - 'bin\'
        - '\Tools\'
        - '\SMSComponent\'
    ParentImage|endswith: '\services.exe'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Image`	match	`\SMSComponent\`	`excludes:Image` `field:"Image" value:"\SMSComponent\"`
`Image`	match	`\Tools\`	`excludes:Image` `field:"Image" value:"\Tools\"`
`Image`	match	`bin\`	`excludes:Image` `field:"Image" value:"bin\"`
`ParentImage`	ends_with	`\services.exe`	`excludes:ParentImage` `field:"ParentImage" value:"\services.exe"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	match	`\htdocs\` `\wmpub\` `\wwwroot\`	`field:"Image" kind:match`