Sigma rule: Webshell Hacking Activity Patterns

Rule

Title

Webshell Hacking Activity Patterns

Status

test

Level

high

Author

Florian Roth (Nextron Systems)

Date

2022-03-17

Modified

2023-11-09

File

rules/windows/process_creation/proc_creation_win_webshell_hacking.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system

Log source

product

windows

category

process_creation

Detection

# Webserver
 selection_webserver_image:
     ParentImage|endswith:
         - '\caddy.exe'
         - '\httpd.exe'
         - '\nginx.exe'
         - '\php-cgi.exe'
         - '\w3wp.exe'
         - '\ws_tomcatservice.exe'
 selection_webserver_characteristics_tomcat1:
     ParentImage|endswith:
         - '\java.exe'
         - '\javaw.exe'
     ParentImage|contains:
         - '-tomcat-'
         - '\tomcat'
 selection_webserver_characteristics_tomcat2:
     ParentImage|endswith:
         - '\java.exe'
         - '\javaw.exe'
     CommandLine|contains:
         - 'catalina.jar'
         - 'CATALINA_HOME'
 # Suspicious child processes
 selection_child_1:
     # Process dumping
     CommandLine|contains|all:
         - 'rundll32'
         - 'comsvcs'
 selection_child_2:
     # Winrar exfil
     CommandLine|contains|all:
         - ' -hp'
         - ' a '
         - ' -m'
 selection_child_3:
     # User add
     CommandLine|contains|all:
         - 'net'
         - ' user '
         - ' /add'
 selection_child_4:
     CommandLine|contains|all:
         - 'net'
         - ' localgroup '
         - ' administrators '
         - '/add'
 selection_child_5:
     Image|endswith:
         # Credential stealing
         - '\ntdsutil.exe'
         # AD recon
         - '\ldifde.exe'
         - '\adfind.exe'
         # Process dumping
         - '\procdump.exe'
         - '\Nanodump.exe'
         # Destruction / ransom groups
         - '\vssadmin.exe'
         - '\fsutil.exe'
 selection_child_6:
     # SUspicious patterns
     CommandLine|contains:
         - ' -decode '  # Used with certutil
         - ' -NoP '  # Often used in malicious PowerShell commands
         - ' -W Hidden '  # Often used in malicious PowerShell commands
         - ' /decode '  # Used with certutil
         - ' /ticket:'  # Rubeus
         - ' sekurlsa'  # Mimikatz
         - '.dmp full'  # Process dumping method apart from procdump
         - '.downloadfile('  # PowerShell download command
         - '.downloadstring('  # PowerShell download command
         - 'FromBase64String' # PowerShell encoded payload
         - 'process call create' # WMIC process creation
         - 'reg save '  # save registry SAM - syskey extraction
         - 'whoami /priv'
 condition: 1 of selection_webserver_* and 1 of selection_child_*

False positives (as the rule lists them)

• Unlikely

Tags

• attack.persistence
• attack.discovery
• attack.t1505.003
• attack.t1018
• attack.t1033
• attack.t1087

MITRE ATT&CK ids this rule names

• T1018
• T1033
• T1087
• T1505.003

References

• https://youtu.be/7aemGhaE9ds?t=641

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_webshell_hacking.yml