title: Shells Spawned by Web Servers
id: 8202070f-edeb-4d31-a010-a26c72ac5600
status: test
description: Detects web servers that spawn shell processes which could be the result of a successfully placed web shell or another attack
author: Thomas Patzke, Florian Roth, Zach Stanford @svch0st, Tim Shelton, Nasreddine Bencherchali (update)
date: 2019/01/16
modified: 2022/08/17
references:
    - https://media.defense.gov/2020/Jun/09/2002313081/-1/-1/0/CSI-DETECT-AND-PREVENT-WEB-SHELL-MALWARE-20200422.PDF
tags:
    - attack.persistence
    - attack.t1505.003
    - attack.t1190
logsource:
    category: process_creation
    product: windows
detection:
    selection_webserver_image:
        ParentImage|endswith:
            - '\w3wp.exe'
            - '\php-cgi.exe'
            - '\nginx.exe'
            - '\httpd.exe'
            - '\caddy.exe'
            - '\ws_TomcatService.exe'
            - '\tomcat.exe'
            - '\UMWorkerProcess.exe'  # https://www.fireeye.com/blog/threat-research/2021/03/detection-response-to-exploitation-of-microsoft-exchange-zero-day-vulnerabilities.html
    selection_webserver_characteristics_tomcat1:
        ParentImage|endswith:
            - '\java.exe'
            - '\javaw.exe'
        ParentImage|contains:
            - '-tomcat-'
            - '\tomcat'
    selection_webserver_characteristics_tomcat2:
        ParentImage|endswith:
            - '\java.exe'
            - '\javaw.exe'
        ParentCommandLine|contains:
            - 'catalina.jar'
            - 'CATALINA_HOME'
            - 'catalina.home'
    anomaly_children:
        Image|endswith:
            - '\cmd.exe'
            - '\sh.exe'
            - '\bash.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\bitsadmin.exe'
            - '\arp.exe'
            - '\at.exe'
            - '\certutil.exe'
            - '\dsget.exe'
            - '\dsquery.exe'
            - '\find.exe'
            - '\findstr.exe'
            - '\fsutil.exe'
            - '\hostname.exe'
            - '\ipconfig.exe'
            - '\nbtstat.exe'
            - '\net.exe'
            - '\net1.exe'
            - '\netdom.exe'
            - '\netsh.exe'
            - '\netstat.exe'
            - '\nltest.exe'
            - '\nslookup.exe'
            - '\ntdutil.exe'
            - '\pathping.exe'
            - '\ping.exe'
            - '\qprocess.exe'
            - '\query.exe'
            - '\qwinsta.exe'
            - '\reg.exe'
            - '\rundll32.exe'
            - '\sc.exe'
            - '\schtasks.exe'
            - '\systeminfo.exe'
            - '\tasklist.exe'
            - '\tracert.exe'
            - '\ver.exe'
            - '\vssadmin.exe'
            - '\wevtutil.exe'
            - '\whoami.exe'
            - '\wmic.exe'
            - '\wusa.exe'
    false_positive1:
        CommandLine|endswith: 'Windows\system32\cmd.exe /c C:\ManageEngine\ADManager "Plus\ES\bin\elasticsearch.bat -Enode.name=RMP-NODE1 -pelasticsearch-pid.txt'
    false_positive2:
        CommandLine|contains|all:
            - 'sc query' 
            - 'ADManager Plus'
    condition: 1 of selection* and anomaly_children and not 1 of false_positive*
fields:
    - CommandLine
    - ParentCommandLine
falsepositives:
    - Particular web applications may spawn a shell process legitimately
level: high