Detection rules › Splunk
IIS Worker (W3WP) Spawn Command Line (Windows Event Log)
IIS instances (w3wp.exe) host various web-facing client services such as Outlook on the web (formerly known as Outlook Web App or OWA) or Exchange admin center (EAC; formerly known as the Exchange Control Panel or ECP). This use case looks for w3wp executions of command terminal
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1505.004 Server Software Component: IIS Components |
| Stealth | T1218 System Binary Proxy Execution |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4688 | A new process has been created. |
Rule body yaml
id: '6108.6588'
title: IIS Worker (W3WP) Spawn Command Line
description: 'IIS instances (w3wp.exe) host various web-facing client services such
as Outlook on the web (formerly known as Outlook Web App or OWA) or Exchange admin
center (EAC; formerly known as the Exchange Control Panel or ECP). This use case
looks for w3wp executions of command terminal. - Threat Actor Association: CL-STA-0043,
OilRig -- Software Association: ALPHV/BlackCat, Clop'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
"<EventID>4688<" OR Type=Process) TERM(w3wp) (TERM(cmd) OR TERM(powershell))| regex
Creator_Process_Name="(?i)w3wp"| regex New_Process_Name="(?i)cmd\.exe|powershell(\_ISE)?\.exe|pwsh\.exe|csc\.exe"
| table _time, host, user, signature_id, process, process_*, parent_process_* |
bin span=1s | stats values(*) as * by _time, host, process_name | eventstats c(process_name)
as c_process_name by process_name| where c_process_name < 25 '
techniques:
- persistence:server software component:iis components
- defense-evasion:system binary proxy execution
technique_id:
- T1505.004
- T1218
data_category:
- Windows event logs
references:
- https://www.microsoft.com/security/blog/2021/02/11/web-shell-attacks-continue-to-rise/
- https://www.huntress.com/blog/moveit-transfer-critical-vulnerability-rapid-response
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process) TERM(w3wp) (TERM(cmd) OR TERM(powershell))
Stage 2: regex
| regex Creator_Process_Name="(?i)w3wp"
Stage 3: regex
| regex New_Process_Name="(?i)cmd\.exe|powershell(\_ISE)?\.exe|pwsh\.exe|csc\.exe"
Stage 4: table
| table _time, host, user, signature_id, process, process_*, parent_process_*
Stage 5: bucket
| bin span=1s
Stage 6: stats
| stats values(*) as * by _time, host, process_name
Stage 7: eventstats
| eventstats c(process_name) as c_process_name by process_name
Stage 8: where
| where c_process_name < 25
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
Creator_Process_Name | regex_match |
|
EventCode | eq |
|
New_Process_Name | regex_match |
|
c_process_name | lt |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>4688<" |
| 1 | TERM |
| 1 | w3wp |
| 1 | TERM |
| 1 | cmd |
| 1 | TERM |
| 1 | powershell |