Unusual Web Config File Access

  1[metadata]
  2creation_date = "2025/07/23"
  3integration = ["endpoint"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects unusual access to the web.config file, which contains sensitive credential information such as database
 11connection strings, machineKey validation/decryption keys, and SAML/OAuth token settings. Attackers can use the
 12information extracted to forge malicious __VIEWSTATE requests for persistent RCE on the web server or pivot to the SQL
 13server using exposed connection strings.
 14"""
 15from = "now-9m"
 16index = ["logs-endpoint.events.file-*"]
 17language = "kuery"
 18license = "Elastic License v2"
 19name = "Unusual Web Config File Access"
 20references = [
 21    "https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/",
 22]
 23risk_score = 73
 24rule_id = "5841b80f-a1f8-4c00-a966-d2cc4a7a82e4"
 25severity = "high"
 26tags = [
 27    "Domain: Endpoint",
 28    "OS: Windows",
 29    "Use Case: Threat Detection",
 30    "Tactic: Credential Access",
 31    "Data Source: Elastic Defend",
 32    "Resources: Investigation Guide",
 33    "Noise: Low",
 34    "Performance: Normal",
 35    "Rule Type: New Terms",
 36    "Platform: Windows",
 37]
 38timestamp_override = "event.ingested"
 39type = "new_terms"
 40
 41query = '''
 42event.category:file and host.os.type:windows and event.action:open and
 43  file.name:"web.config" and file.path : *VirtualDirectories* and
 44  not process.executable: (
 45        "C:\Program Files\Microsoft Security Client\MsMpEng.exe" or
 46        "C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe" or
 47        "C:\Windows\System32\MRT.exe" or
 48        "C:\Windows\System32\inetsrv\w3wp.exe"
 49  )
 50'''
 51
 52note = """## Triage and analysis
 53
 54### Investigating Unusual Web Config File Access
 55
 56#### Possible investigation steps
 57
 58- What process opened which "web.config" path, and what secrets could it expose?
 59  - Why: IIS, SharePoint, federation, or shared application configs can expose connection strings, MachineKey validation/decryption keys, and OAuth/SAML settings for ViewState forgery or credential pivots.
 60  - Focus: `file.path`, `process.entity_id`, `process.executable`, `user.id`, and `host.id`.
 61  - Implication: escalate when `file.path` points to SharePoint, federation, shared application, database-connected app, or another high-value IIS root; lower suspicion only when asset inventory or owner confirmation verifies a non-sensitive test path and later endpoint evidence stays inside that exact workflow.
 62
 63- Is the reader a recognized maintenance component or an anomalous binary?
 64  - Focus: `process.executable`, `process.command_line`, `process.code_signature.subject_name`, `process.code_signature.trusted`, and `process.parent.executable`.
 65  - Implication: escalate when the reader is unsigned, user-writable, renamed, or launched by a shell, script host, web worker, or remote-admin chain; lower suspicion when signer, path, command line, and parent match one recognized deployment, backup, scan, or web-maintenance component. Identity alone does not clear the read.
 66
 67- Do the account and lineage fit application maintenance on this host?
 68  - Focus: `user.id`, `user.name`, `process.parent.executable`, and `process.Ext.ancestry`.
 69  - Implication: escalate when the account lacks a web-admin, service, deployment, backup, or response role, the service identity is unexpected, or the parent is a shell, script host, web worker, or remote-admin tool; lower suspicion when identity, parent, and ancestry match one recognized workflow.
 70
 71- Did the same process enumerate or stage config secrets beyond one bounded read?
 72  - Focus: same-process file events by `host.id` and `process.entity_id`: `event.action`, `file.path`, and `file.Ext.original.path`; look for sibling "web.config", "applicationHost.config", backup or copied configs, script output, web-shell files, or archives. $investigate_0
 73  - Implication: escalate when the process walks multiple site roots, opens server-wide config, reads backups, or writes collection/web-shell artifacts; lower suspicion when file activity stays inside one expected application path with no copy, archive, or helper-file staging.
 74
 75- Did direct child process activity show extraction, staging, or attempted use of exposed secrets?
 76  - Why: shell or encoded PowerShell chains can collect config contents, extract MachineKey material, or stage a web shell.
 77  - Focus: direct child process events on `host.id` where `process.parent.entity_id` matches `process.entity_id`: `process.executable`, `process.command_line`, and `process.parent.executable`. $investigate_1
 78  - Hint: expand manually from direct children into deeper descendants or the recovered process tree.
 79  - Implication: escalate when children or descendants include "cmd.exe", PowerShell, archive tools, database clients, web-shell writers, or commands referencing MachineKey, validation keys, decryption keys, config copies, or archive staging; absent child events lower immediate-use concern only if the reader, path, and file pattern are already bounded.
 80
 81- If local evidence is suspicious or unresolved, does endpoint telemetry show broader config access or staging by the same user or host?
 82  - Focus: same-`user.id` file events with `file.path` values showing additional config reads, copied configs, script output, web-shell files, or archives. $investigate_2
 83  - Hint: if the user identity is shared or sparse, review same-`host.id` and `user.id` process events: `process.executable`, `process.command_line`, and `process.Ext.ancestry`. $investigate_3
 84  - Implication: expand scope when either view shows additional config reads, collection artifacts, staged scripts, or suspicious administration around the read window; keep the case local only when broader endpoint telemetry shows no additional staging and local evidence fits one exact workflow.
 85
 86- Escalate when path, reader identity, lineage, same-process file behavior, child/descendant behavior, or related alerts indicate unauthorized config access or secret staging; close only when path, process, user/session, lineage, and same-process file evidence bind to one recognized maintenance, deployment, backup, or response workflow and outside confirmation verifies legitimacy telemetry cannot prove; preserve artifacts and escalate when evidence is mixed or incomplete.
 87
 88### False positive analysis
 89
 90- AV/EDR products may open web.config during scans. Confirm trusted-signed AV binary, SYSTEM or service account, and no same-process config copy, archive, or staging.
 91- Deployment, backup, scanning, or IR workflows can open web.config. Confirm `process.executable`, signer, parent, `file.path`, `user.id`, and `host.id` align with one workflow, with no config copy, archive, web-shell, shell descendants, or broader enumeration. Do not close on historical similarity alone.
 92- Build exceptions from `process.executable`, signer, parent, exact `file.path` root, `user.id`, and `host.id`. Avoid exceptions on "web.config" or host alone. For this new-terms rule, keep first-time cases as candidates until confirmed repeats show the same workflow.
 93
 94### Response and remediation
 95
 96- If confirmed benign, reverse temporary containment and document which evidence proved the workflow: reader identity, parent lineage, `file.path`, `user.id`, `host.id`, and same-process file pattern. Create an exception only for the independently confirmed minimum workflow, not for "web.config" broadly.
 97- If suspicious but unconfirmed, preserve the alert details, process tree, same-process file timeline, targeted config path, suspected copies, archives, script output, web-shell files, and case notes before containment. Apply reversible containment first, such as heightened monitoring, temporary account restrictions, or temporary outbound controls; isolate the host only if copied config, web-shell creation, or secret reuse is confirmed and service impact is acceptable.
 98- If confirmed malicious, preserve the reader process instance, parent chain, targeted `file.path`, copied or staged config, script output, web-shell files, archives, and case notes before containment. Then contain the affected host or account based on the unauthorized reader, high-value path, enumeration, staged artifacts, or descendant process evidence, and record those identifiers before terminating processes or deleting files.
 99- Rotate secrets exposed through the targeted `file.path`, including database credentials, MachineKey validation/decryption keys, OAuth/SAML secrets, and shared service-account credentials. Prioritize production, internet-facing, and shared application secrets.
100- Eradicate only the webshells, scripts, copied configuration files, archives, persistence mechanisms, and altered application files identified during the investigation; restore affected application configuration from known-good state and remediate the initial access or privilege path that allowed the read.
101"""
102
103setup = """## Setup
104
105This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
106
107Setup instructions: https://ela.st/install-elastic-defend
108"""
109
110[rule.investigation_fields]
111field_names = [
112    "@timestamp",
113    "event.action",
114    "host.name",
115    "host.id",
116    "user.name",
117    "user.id",
118    "user.domain",
119    "process.entity_id",
120    "process.executable",
121    "process.command_line",
122    "process.parent.executable",
123    "process.code_signature.subject_name",
124    "process.code_signature.trusted",
125    "file.path",
126]
127
128[transform]
129
130[[transform.investigate]]
131label = "File events for the same process"
132description = ""
133providers = [
134  [
135    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" },
136    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
137    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
138  ]
139]
140relativeFrom = "now-1h"
141relativeTo = "now"
142
143[[transform.investigate]]
144label = "Direct child process events"
145description = ""
146providers = [
147  [
148    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
149    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
150    { excluded = false, field = "process.parent.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
151  ]
152]
153relativeFrom = "now-1h"
154relativeTo = "now"
155
156[[transform.investigate]]
157label = "File events for the same user"
158description = ""
159providers = [
160  [
161    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" },
162    { excluded = false, field = "user.id", queryType = "phrase", value = "{{user.id}}", valueType = "string" }
163  ]
164]
165relativeFrom = "now-48h/h"
166relativeTo = "now"
167
168[[transform.investigate]]
169label = "Process events for the same host and user"
170description = ""
171providers = [
172  [
173    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
174    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
175    { excluded = false, field = "user.id", queryType = "phrase", value = "{{user.id}}", valueType = "string" }
176  ]
177]
178relativeFrom = "now-48h/h"
179relativeTo = "now"
180
181[[rule.filters]]
182
183[rule.filters.meta]
184negate = true
185[rule.filters.query.wildcard."process.executable"]
186case_insensitive = true
187value = "?:\\\\Program Files\\\\Common Files\\\\microsoft shared\\\\Web Server Extensions\\\\*\\\\BIN\\\\*"
188
189[rule.new_terms]
190field = "new_terms_fields"
191value = ["process.executable", "user.id"]
192[[rule.new_terms.history_window_start]]
193field = "history_window_start"
194value = "now-7d"
195
196[[rule.threat]]
197framework = "MITRE ATT&CK"
198
199[[rule.threat.technique]]
200id = "T1552"
201name = "Unsecured Credentials"
202reference = "https://attack.mitre.org/techniques/T1552/"
203
204[[rule.threat.technique.subtechnique]]
205id = "T1552.001"
206name = "Credentials In Files"
207reference = "https://attack.mitre.org/techniques/T1552/001/"
208
209[rule.threat.tactic]
210id = "TA0006"
211name = "Credential Access"
212reference = "https://attack.mitre.org/tactics/TA0006/"
213
214[[rule.threat]]
215framework = "MITRE ATT&CK"
216
217[[rule.threat.technique]]
218id = "T1005"
219name = "Data from Local System"
220reference = "https://attack.mitre.org/techniques/T1005/"
221
222[rule.threat.tactic]
223id = "TA0009"
224name = "Collection"
225reference = "https://attack.mitre.org/tactics/TA0009/"