Sigma rule: Suspicious File Write to Webapps Root Directory

Rule

Title

Suspicious File Write to Webapps Root Directory

Status

experimental

Level

medium

Author

Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2025-10-20

File

rules/windows/file/file_event/file_event_win_susp_file_write_in_webapps_root.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects suspicious file writes to the root directory of web applications, particularly Apache web servers or Tomcat servers.
This may indicate an attempt to deploy malicious files such as web shells or other unauthorized scripts.

Log source

product

windows

category

file_event

Detection

# Add more suspicious processes or paths or extensions as needed
selection_susp_img:
    Image|endswith:
        - '\dotnet.exe'
        - '\w3wp.exe'
        - '\java.exe'
selection_servers:
    TargetFilename|contains:
        - '\apache'
        - '\tomcat'
selection_path:
    TargetFilename|contains: '\webapps\ROOT\'
selection_susp_extensions:
    TargetFilename|endswith: '.jsp'
condition: all of selection_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.persistence
• attack.t1505.003
• attack.initial-access
• attack.t1190

MITRE ATT&CK ids this rule names

• T1190
• T1505.003

References

• https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/file/file_event/file_event_win_susp_file_write_in_webapps_root.yml