title: Shells Spawned by Web Servers
id: 8202070f-edeb-4d31-a010-a26c72ac5600
status: test
description: Web servers that spawn shell processes could be the result of a successfully placed web shell or an other attack
author: Thomas Patzke, Florian Roth
date: 2019/01/16
modified: 2022/03/17
tags:
   - attack.persistence
   - attack.t1505.003
   - attack.t1190
logsource:
   category: process_creation
   product: windows
detection:
   selection_webserver_image:
      ParentImage|endswith:
         - '\w3wp.exe'
         - '\php-cgi.exe'
         - '\nginx.exe'
         - '\httpd.exe'
         - '\caddy.exe'
         - '\ws_TomcatService.exe'
         - '\tomcat.exe'
         - '\UMWorkerProcess.exe'  # https://www.fireeye.com/blog/threat-research/2021/03/detection-response-to-exploitation-of-microsoft-exchange-zero-day-vulnerabilities.html
   selection_webserver_characteristics_tomcat1:
      ParentImage|endswith: 
         - '\java.exe'
         - '\javaw.exe'
      ParentImage|contains: 
         - '-tomcat-'
         - '\tomcat'
   selection_webserver_characteristics_tomcat2:
      ParentImage|endswith: 
         - '\java.exe'
         - '\javaw.exe'
      CommandLine|contains: 
         - 'catalina.jar'
         - 'CATALINA_HOME'
   anomaly_children:
      Image|endswith:
         - '\cmd.exe'
         - '\sh.exe'
         - '\bash.exe'
         - '\powershell.exe'
         - '\bitsadmin.exe'
   condition: 1 of selection* and anomaly_children
fields:
   - CommandLine
   - ParentCommandLine
falsepositives:
   - Particular web applications may spawn a shell process legitimately
level: high

