Web Shell Detection: Script Process Child of Common Web Processes

  1[metadata]
  2creation_date = "2021/08/24"
  3integration = ["endpoint", "windows", "system", "sentinel_one_cloud_funnel", "m365_defender", "crowdstrike"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = "Identifies suspicious commands executed via a web server, which may suggest a vulnerability and remote shell access."
 10false_positives = [
 11    """
 12    Security audits, maintenance, and network administrative scripts may trigger this alert only when parent context,
 13    child identity, command scope, service identity, and available artifact or destination evidence align to the same
 14    bounded workflow.
 15    """,
 16]
 17from = "now-9m"
 18index = [
 19    "endgame-*",
 20    "logs-crowdstrike.fdr*",
 21    "logs-endpoint.events.process-*",
 22    "logs-m365_defender.event-*",
 23    "logs-sentinel_one_cloud_funnel.*",
 24    "logs-system.security*",
 25    "logs-windows.sysmon_operational-*",
 26    "winlogbeat-*",
 27]
 28language = "kuery"
 29license = "Elastic License v2"
 30name = "Web Shell Detection: Script Process Child of Common Web Processes"
 31references = [
 32    "https://www.microsoft.com/security/blog/2020/02/04/ghost-in-the-shell-investigating-web-shell-attacks/",
 33    "https://www.elastic.co/security-labs/elastic-response-to-the-the-spring4shell-vulnerability-cve-2022-22965",
 34    "https://www.elastic.co/security-labs/hunting-for-persistence-using-elastic-security-part-1",
 35]
 36risk_score = 73
 37rule_id = "2917d495-59bd-4250-b395-c29409b76086"
 38severity = "high"
 39tags = [
 40    "Domain: Endpoint",
 41    "OS: Windows",
 42    "Use Case: Threat Detection",
 43    "Tactic: Persistence",
 44    "Resources: Investigation Guide",
 45    "Data Source: Elastic Endgame",
 46    "Data Source: Elastic Defend",
 47    "Data Source: SentinelOne",
 48    "Data Source: Windows Security Event Logs",
 49    "Data Source: Microsoft Defender XDR",
 50    "Data Source: Sysmon",
 51    "Data Source: Crowdstrike",
 52    "Noise: High",
 53    "Performance: Normal",
 54    "Profile: Aggressive",
 55    "Threat: Web Shell",
 56    "Rule Type: New Terms",
 57    "Platform: Windows",
 58]
 59timestamp_override = "event.ingested"
 60type = "new_terms"
 61
 62query = '''
 63host.os.type:windows and event.category:process and event.type:start and process.args : * and
 64  process.parent.name:("w3wp.exe" or "httpd.exe" or "nginx.exe" or "php.exe" or "php-cgi.exe" or "tomcat.exe" or "ArcSOC.exe") and
 65  (
 66    process.name : ("cmd.exe" or "cscript.exe" or "powershell.exe" or "pwsh.exe" or "powershell_ise.exe" or "wmic.exe" or "wscript.exe") or
 67    process.name.caseless : ("cmd.exe" or "cscript.exe" or "powershell.exe" or "pwsh.exe" or "powershell_ise.exe" or "wmic.exe" or "wscript.exe")
 68  ) and
 69  not
 70  (
 71    process.command_line : (
 72      "cmd.exe /c mode CON" or
 73      "cmd.exe /s /c \"mode CON\"" or
 74      "cmd.exe /c \"mode\"" or
 75      "cmd.exe /s /c \"tput colors 2>&1\"" or
 76      "cmd.exe /s /c \"stty 2> NUL\"" or
 77      "cmd.exe /s /c \"stty 2>&1\"" or
 78      "cmd.exe /c \"stty 2>&1\"" or
 79      "cmd.exe /s /c \"ipconfig /all 2>&1\"" or
 80      "cmd.exe /s /c \"echo '%os%'\"" or
 81      *.\\install\\awk.exe*
 82    ) or
 83    process.args : (\(git or (*artisan* and *queue\:work*) or *rmdir* or "mode CON" or ver or ls or mode or dir) or
 84
 85    (process.name:cmd.exe and process.parent.args : "c:\\\\xampp\\\\htdocs\\\\open-audit\\\\index.php") or
 86
 87    (process.name:cmd.exe and process.args:("/V:ON" and "--header-html")) or
 88
 89    (process.parent.args:"WebCession" and process.args:E\:\\Data\\CLM\\cession\\*.bat) or
 90
 91    (process.parent.executable :"D:\\AiDKlinik\\php\\php-cgi.exe" and process.args:D\:\\AiDKlinik\\web*) or
 92
 93    (process.parent.args :"E:/wamp64/bin/apache/apache2.4.62.1" and process.args:node*) or
 94
 95    (process.parent.name:"php.exe" and process.name:"cmd.exe" and process.args:("/V:ON" and "/E:ON"))
 96  )
 97'''
 98
 99note = """## Triage and analysis
100
101#### Possible investigation steps
102
103- What execution path did the alert capture?
104  - Focus: child `process.executable` / `process.command_line`; web-parent `process.parent.name`, `process.parent.executable`, and `process.parent.command_line` for IIS/Apache/nginx/PHP CGI/Tomcat/ArcGIS.
105  - Implication: escalate when a web-facing parent launches a shell, script host, downloader, archive tool, or admin utility outside bounded tasks; lower only when parent context, child path, and command match one exact deployment, health-check, log rotation, or support task.
106- Is the child command administration or post-exploitation?
107  - Focus: `process.command_line`: WMIC, download cradles, archive creation, account/system discovery, service control, credential access, script-host flags, or web-root/temp/backup/app-content paths.
108  - Hint: for PowerShell, reconstruct script blocks by `host.id` and `process.pid` via `powershell.file.script_block_text`, `powershell.sequence`, and `powershell.total`; missing PowerShell telemetry is unresolved, not benign.
109  - Implication: escalate when the command stages payloads, runs discovery, creates accounts, changes services, or writes to web-accessible or temp paths; lower suspicion when bounded to one recognized deployment, health-check, log rotation, or support task.
110- Is user context human admin or service identity?
111  - Why: web-process children often inherit app-pool or service identity; `user.id`, `user.name`, and `user.domain` do not prove human initiation.
112  - Focus: `@timestamp`, `user.id`, `user.name`, `process.Ext.session_info.logon_type`, and `process.parent.command_line`.
113  - Implication: escalate when service or network logon context launches interactive troubleshooting, remote administration, or off-hours shell activity without a matching window; lower suspicion when identity, logon type, parent pool/service, and command scope fit one exact workflow.
114- Does child binary identity fit its command?
115  - Focus: `process.executable`, `process.pe.original_file_name`, `process.hash.sha256`, `process.code_signature.subject_name`, and `process.code_signature.trusted`.
116  - Implication: escalate when the child is renamed, unsigned/untrusted, user-writable, or mismatched to original file name; lower suspicion when identity and path match stable tooling, but continue because trusted binaries can carry web-shell commands.
117- Did file telemetry show web-shell placement, staging, or config changes?
118  - Focus: if file telemetry exists, review `host.id` file events for child `process.entity_id` or `process.pid`, checking `file.path`, `file.Ext.original.path`, and `file.Ext.windows.zone_identifier`. $investigate_1
119  - Hint: web-root script writes without later child starts are adjacent-variant evidence; if the child writes a script or executable, query starts where `process.executable` equals that path on same `host.id`.
120  - Implication: escalate when the child writes ASPX, ASP, PHP, JSP, JS, BAT, PS1, EXE, DLL, JAR, WAR, or archives to web-accessible/temp/user-writable paths, or a written artifact later executes; missing file telemetry is unresolved, not benign, and absence does not close.
121- Did the child launch second-stage processes?
122  - Focus: child starts on `host.id` where `process.parent.entity_id` equals child `process.entity_id`, checking `process.executable`, `process.command_line`, and `process.hash.sha256`. $investigate_2
123  - Implication: escalate when descendants include shells, script hosts, downloaders, archive tools, credential utilities, service control, or persistence tooling; absence only narrows impact when command, file, network, and related alerts also fit a benign workflow.
124- Did DNS/network telemetry show retrieval or control?
125  - Focus: if DNS/network telemetry exists, review child `process.entity_id` events on `host.id`, separating `dns.question.name` / `dns.resolved_ip` from `destination.ip` / `destination.port`; compare role with command intent. $investigate_3
126  - Hint: map DNS results to later connection IPs before linking query and connection; if a third-party alert lacks `process.entity_id`, recover the child by `host.id`, `process.pid`, and `@timestamp`. Missing network/DNS telemetry is unresolved, not benign.
127  - Implication: escalate when the child retrieves tools from public infrastructure, reaches rare/misaligned destinations, or connects outside web-server administration; decide from alert-local process evidence and corroboration when DNS/network telemetry is unavailable.
128- Do related alerts show broader compromise?
129  - Focus: same-web-parent starts and 48h `host.id` alerts for web-shell, credential-access, discovery, archive, lateral-movement, persistence, or anti-forensics.
130    - $investigate_4
131    - $investigate_0
132  - Implication: escalate scope when alerts cluster around the same server role, child command family, or staged artifacts; absence only narrows response scope when local parent-child, command, identity, file, and network evidence are explained.
133- What disposition fits?
134  - Implication: escalate on unexplained server-side execution, exploit-like command intent, suspicious child identity, payload staging, rare destinations, or broader compromise; do not wait for optional pivots when alert-local process evidence is unsafe. Close only when same-host alert-window telemetry proves one exact benign web-server workflow; use outside confirmation for legitimacy gaps. If evidence is mixed or visibility incomplete, preserve artifacts and escalate.
135
136### False positive analysis
137
138- Web deployment, post-install validation, health checks, vendor extension install, ArcGIS publishing, or maintenance can spawn "cmd.exe", PowerShell, or "wscript.exe" from web components. Confirm only when parent, child, command, service identity, and artifact/destination evidence describe the same alert-window workflow with no unexpected web-content writes, rare callbacks, or contradictions.
139- If telemetry proves shape but not legitimacy, require matching change, deployment, runbook, vendor, or owner confirmation; use prior occurrences post-closure to test exception stability.
140- Build exceptions from minimum confirmed pattern: web parent command, child executable/hash/signature, command line, `user.id`, `host.id`, and bounded content path or destination when decisive. Avoid parent name, `process.name`, or `host.id` alone.
141
142### Response and remediation
143
144- If confirmed benign, reverse temporary containment, document exact parent, child, command, service identity, artifact/destination evidence, and confirmation, and create exceptions only from that pattern.
145- If suspicious but unconfirmed, preserve the alert/export, process tree, child/parent entity IDs, command lines, hash, staged-file copies, destinations, related alerts, and web/app logs around `@timestamp` before containment or cleanup.
146- Apply reversible containment tied to evidence: block confirmed malicious destinations, restrict affected site/app access, disable exposed extension or virtual directory, or increase `host.id` monitoring. Isolate only when evidence and server criticality permit.
147- If confirmed malicious, contain the host or terminate the child only after preservation; if direct response is unavailable, escalate with process/artifact/destination/server-log evidence to the team that can contain the server, disable the exposed path, or stop the service.
148- Before deletion/restoration, hunt for the same hash, child command, staged path, domain, IP, and port across hosts/accounts. Then remove web shells, scripts, archives, scheduled tasks, dropped utilities, and persistence; restore known-good content/config; rotate exposed service, app, or admin credentials if secrets may be exposed.
149- After containment, patch the implicated app, extension, framework, or server component; review the internet-exposed site/service that launched the child; retain endpoint, network, and web logs; document script-only variants or logging gaps.
150"""
151
152setup = """## Setup
153
154This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
155
156Setup instructions: https://ela.st/install-elastic-defend
157
158### Additional data sources
159
160This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
161
162- [CrowdStrike](https://ela.st/crowdstrike-integration)
163- [Microsoft Defender XDR](https://ela.st/m365-defender)
164- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
165- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
166- [Windows Process Creation Logs](https://ela.st/audit-process-creation)
167"""
168
169[[rule.filters]]
170[rule.filters.meta]
171negate = true
172[rule.filters.query.wildcard."process.command_line"]
173case_insensitive = true
174value = "*?:\\\\Program Files\\\\*"
175
176[[rule.filters]]
177[rule.filters.meta]
178negate = true
179[rule.filters.query.wildcard."process.command_line"]
180case_insensitive = true
181value = "*?:\\\\Program Files (x86)\\\\*"
182
183[rule.investigation_fields]
184field_names = [
185    "@timestamp",
186    "host.name",
187    "host.id",
188    "user.id",
189    "process.entity_id",
190    "process.pid",
191    "process.executable",
192    "process.command_line",
193    "process.Ext.session_info.logon_type",
194    "process.pe.original_file_name",
195    "process.code_signature.subject_name",
196    "process.code_signature.trusted",
197    "process.hash.sha256",
198    "process.parent.executable",
199    "process.parent.command_line",
200]
201
202[transform]
203
204[[transform.investigate]]
205label = "Alerts associated with the host"
206description = ""
207providers = [
208  [
209    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
210    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
211  ]
212]
213relativeFrom = "now-48h/h"
214relativeTo = "now"
215
216[[transform.investigate]]
217label = "File events for the suspicious child process"
218description = ""
219providers = [
220  [
221    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" },
222    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
223    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
224  ],
225  [
226    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" },
227    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
228    { excluded = false, field = "process.pid", queryType = "phrase", value = "{{process.pid}}", valueType = "string" }
229  ]
230]
231relativeFrom = "now-1h"
232relativeTo = "now"
233
234[[transform.investigate]]
235label = "Child process events from the suspicious child"
236description = ""
237providers = [
238  [
239    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
240    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
241    { excluded = false, field = "process.parent.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
242  ]
243]
244relativeFrom = "now-1h"
245relativeTo = "now"
246
247[[transform.investigate]]
248label = "Network events for the suspicious child process"
249description = ""
250providers = [
251  [
252    { excluded = false, field = "event.category", queryType = "phrase", value = "network", valueType = "string" },
253    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
254    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
255  ],
256  [
257    { excluded = false, field = "event.category", queryType = "phrase", value = "network", valueType = "string" },
258    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
259    { excluded = false, field = "process.pid", queryType = "phrase", value = "{{process.pid}}", valueType = "string" }
260  ]
261]
262relativeFrom = "now-1h"
263relativeTo = "now"
264
265[[transform.investigate]]
266label = "Process events from the same web parent"
267description = ""
268providers = [
269  [
270    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
271    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
272    { excluded = false, field = "process.parent.entity_id", queryType = "phrase", value = "{{process.parent.entity_id}}", valueType = "string" }
273  ]
274]
275relativeFrom = "now-1h"
276relativeTo = "now"
277
278[rule.new_terms]
279field = "new_terms_fields"
280value = ["host.id", "process.command_line"]
281[[rule.new_terms.history_window_start]]
282field = "history_window_start"
283value = "now-7d"
284
285[[rule.threat]]
286framework = "MITRE ATT&CK"
287
288[[rule.threat.technique]]
289id = "T1505"
290name = "Server Software Component"
291reference = "https://attack.mitre.org/techniques/T1505/"
292
293[[rule.threat.technique.subtechnique]]
294id = "T1505.003"
295name = "Web Shell"
296reference = "https://attack.mitre.org/techniques/T1505/003/"
297
298[rule.threat.tactic]
299id = "TA0003"
300name = "Persistence"
301reference = "https://attack.mitre.org/tactics/TA0003/"
302
303[[rule.threat]]
304framework = "MITRE ATT&CK"
305
306[[rule.threat.technique]]
307id = "T1190"
308name = "Exploit Public-Facing Application"
309reference = "https://attack.mitre.org/techniques/T1190/"
310
311[rule.threat.tactic]
312id = "TA0001"
313name = "Initial Access"
314reference = "https://attack.mitre.org/tactics/TA0001/"
315
316[[rule.threat]]
317framework = "MITRE ATT&CK"
318
319[[rule.threat.technique]]
320id = "T1047"
321name = "Windows Management Instrumentation"
322reference = "https://attack.mitre.org/techniques/T1047/"
323
324[[rule.threat.technique]]
325id = "T1059"
326name = "Command and Scripting Interpreter"
327reference = "https://attack.mitre.org/techniques/T1059/"
328
329[[rule.threat.technique.subtechnique]]
330id = "T1059.001"
331name = "PowerShell"
332reference = "https://attack.mitre.org/techniques/T1059/001/"
333
334[[rule.threat.technique.subtechnique]]
335id = "T1059.003"
336name = "Windows Command Shell"
337reference = "https://attack.mitre.org/techniques/T1059/003/"
338
339[[rule.threat.technique.subtechnique]]
340id = "T1059.005"
341name = "Visual Basic"
342reference = "https://attack.mitre.org/techniques/T1059/005/"
343
344[[rule.threat.technique.subtechnique]]
345id = "T1059.007"
346name = "JavaScript"
347reference = "https://attack.mitre.org/techniques/T1059/007/"
348
349[rule.threat.tactic]
350id = "TA0002"
351name = "Execution"
352reference = "https://attack.mitre.org/tactics/TA0002/"