Sigma rule: Chopper Webshell Process Pattern

Rule

Title

Chopper Webshell Process Pattern

Status

test

Level

high

Author

Florian Roth (Nextron Systems), MSTI (query)

Date

2022-10-01

File

rules/windows/process_creation/proc_creation_win_webshell_chopper.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells

Log source

product

windows

category

process_creation

Detection

selection_origin:
    - Image|endswith: '\w3wp.exe'
    - ParentImage|endswith: '\w3wp.exe'
selection_cmdline:
    CommandLine|contains:
        - '&ipconfig&echo'
        - '&quser&echo'
        - '&whoami&echo'
        - '&c:&echo'
        - '&cd&echo'
        - '&dir&echo'
        - '&echo [E]'
        - '&echo [S]'
condition: all of selection_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.persistence
• attack.discovery
• attack.t1505.003
• attack.t1018
• attack.t1033
• attack.t1087

MITRE ATT&CK ids this rule names

• T1018
• T1033
• T1087
• T1505.003

References

• https://www.microsoft.com/security/blog/2022/09/30/analyzing-attacks-using-the-exchange-vulnerabilities-cve-2022-41040-and-cve-2022-41082/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_webshell_chopper.yml