blue-team-tools/rules/windows/sysmon/sysmon_webshell_detection.yml

title: Webshell Detection With Command Line Keywords
description: Detects certain command line parameters often used during reconnissaince activity via web shells
author: Florian Roth
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 1
        ParentImage:
          - '*\apache*'
          - '*\tomcat*'
          - '*\w3wp.exe'
          - '*\php-cgi.exe'
          - '*\nginx.exe'
          - '*\httpd.exe'
        CommandLine:
          - 'whoami'
          - 'net user'
          - 'ping -n'
          - 'systeminfo'
    condition: selection
falsepositives:
    - unknown
level: high