Web Shell Detection: Script Process Child of Common Web Processes

  1[metadata]
  2creation_date = "2021/08/24"
  3integration = ["endpoint", "windows", "system", "sentinel_one_cloud_funnel", "m365_defender", "crowdstrike"]
  4maturity = "production"
  5updated_date = "2026/10/23"
  6
  7[rule]
  8author = ["Elastic"]
  9description = "Identifies suspicious commands executed via a web server, which may suggest a vulnerability and remote shell access."
 10false_positives = [
 11    """
 12    Security audits, maintenance, and network administrative scripts may trigger this alert only when parent context,
 13    child identity, command scope, service identity, and available artifact or destination evidence align to the same
 14    bounded workflow.
 15    """,
 16]
 17from = "now-9m"
 18index = [
 19    "endgame-*",
 20    "logs-crowdstrike.fdr*",
 21    "logs-endpoint.events.process-*",
 22    "logs-m365_defender.event-*",
 23    "logs-sentinel_one_cloud_funnel.*",
 24    "logs-system.security*",
 25    "logs-windows.sysmon_operational-*",
 26    "winlogbeat-*",
 27]
 28language = "kuery"
 29license = "Elastic License v2"
 30name = "Web Shell Detection: Script Process Child of Common Web Processes"
 31references = [
 32    "https://www.microsoft.com/security/blog/2020/02/04/ghost-in-the-shell-investigating-web-shell-attacks/",
 33    "https://www.elastic.co/security-labs/elastic-response-to-the-the-spring4shell-vulnerability-cve-2022-22965",
 34    "https://www.elastic.co/security-labs/hunting-for-persistence-using-elastic-security-part-1",
 35]
 36risk_score = 73
 37rule_id = "2917d495-59bd-4250-b395-c29409b76086"
 38severity = "high"
 39tags = [
 40    "Domain: Endpoint",
 41    "OS: Windows",
 42    "Use Case: Threat Detection",
 43    "Tactic: Persistence",
 44    "Resources: Investigation Guide",
 45    "Data Source: Elastic Endgame",
 46    "Data Source: Elastic Defend",
 47    "Data Source: SentinelOne",
 48    "Data Source: Windows Security Event Logs",
 49    "Data Source: Microsoft Defender XDR",
 50    "Data Source: Sysmon",
 51    "Data Source: Crowdstrike",
 52    "Noise: High",
 53    "Performance: Normal",
 54    "Profile: Aggressive",
 55    "Threat: Web Shell",
 56    "Rule Type: New Terms",
 57    "Platform: Windows",
 58]
 59timestamp_override = "event.ingested"
 60type = "new_terms"
 61
 62query = '''
 63host.os.type: "windows" and
 64event.category: "process" and
 65event.type: "start" and
 66process.args:* and
 67process.parent.name: (
 68  "w3wp.exe" or
 69  "httpd.exe" or
 70  apache*.exe or
 71  "nginx.exe" or
 72  "php.exe" or
 73  "php-cgi.exe" or
 74  "php-win.exe" or
 75  "phpdbg.exe" or
 76  "php-fpm.exe" or
 77  tomcat*.exe or
 78  "ArcSOC.exe" or
 79  "frankenphp.exe" or
 80  "roadrunner.exe" or
 81  "unit.exe" or
 82  "caddy.exe" or
 83  "lighttpd.exe" or
 84  "iisexpress.exe" or
 85  "java.exe" or
 86  "UMWorkerProcess.exe" or
 87  "ws_TomcatService.exe"
 88) and
 89(
 90  process.name: (
 91    "cmd.exe" or
 92    "cscript.exe" or
 93    "powershell.exe" or
 94    "pwsh.exe" or
 95    "powershell_ise.exe" or
 96    "wmic.exe" or
 97    "wscript.exe" or
 98    "mshta.exe" or
 99    "rundll32.exe" or
100    "regsvr32.exe" or
101    "certutil.exe" or
102    "bitsadmin.exe" or
103    "curl.exe" or
104    "wget.exe" or
105    "whoami.exe" or
106    "hostname.exe" or
107    "ipconfig.exe" or
108    "net.exe" or
109    "net1.exe" or
110    "nltest.exe" or
111    "schtasks.exe" or
112    "sc.exe" or
113    "python.exe" or
114    "perl.exe" or
115    "reg.exe" or
116    "netsh.exe" or
117    "ntdsutil.exe" or
118    "vssadmin.exe" or
119    "wevtutil.exe" or
120    "scrcons.exe" or
121    "systeminfo.exe" or
122    "tasklist.exe" or
123    "netstat.exe" or
124    "dsquery.exe" or
125    "dsget.exe" or
126    "netdom.exe"
127  ) or
128  process.name.caseless: (
129    "cmd.exe" or
130    "cscript.exe" or
131    "powershell.exe" or
132    "pwsh.exe" or
133    "powershell_ise.exe" or
134    "wmic.exe" or
135    "wscript.exe" or
136    "mshta.exe" or
137    "rundll32.exe" or
138    "regsvr32.exe" or
139    "certutil.exe" or
140    "bitsadmin.exe" or
141    "curl.exe" or
142    "wget.exe" or
143    "whoami.exe" or
144    "hostname.exe" or
145    "ipconfig.exe" or
146    "net.exe" or
147    "net1.exe" or
148    "nltest.exe" or
149    "schtasks.exe" or
150    "sc.exe" or
151    "python.exe" or
152    "perl.exe" or
153    "ntdsutil.exe" or
154    "vssadmin.exe" or
155    "wevtutil.exe" or
156    "scrcons.exe" or
157    "systeminfo.exe" or
158    "tasklist.exe" or
159    "netstat.exe" or
160    "dsquery.exe" or
161    "dsget.exe" or
162    "netdom.exe"
163  )
164) and 
165  not
166  (
167    process.command_line : (
168      "cmd.exe /c mode CON" or
169      "cmd.exe /s /c \"mode CON\"" or
170      "cmd.exe /c \"mode\"" or
171      "cmd.exe /s /c \"tput colors 2>&1\"" or
172      "cmd.exe /s /c \"stty 2> NUL\"" or
173      "cmd.exe /s /c \"stty 2>&1\"" or
174      "cmd.exe /c \"stty 2>&1\"" or
175      "cmd.exe /s /c \"ipconfig /all 2>&1\"" or
176      "cmd.exe /s /c \"echo '%os%'\"" or
177      *.\\install\\awk.exe*
178    ) or
179    process.args : (\(git or (*artisan* and *queue\:work*) or *rmdir* or "mode CON" or ver or ls or mode or dir) or
180
181    (process.name:cmd.exe and process.parent.args : "c:\\\\xampp\\\\htdocs\\\\open-audit\\\\index.php") or
182
183    (process.name:cmd.exe and process.args:("/V:ON" and "--header-html")) or
184
185    (process.parent.args :"E:/wamp64/bin/apache/apache*" and process.args:node*) or
186
187    (process.parent.name:"php.exe" and process.name:"cmd.exe" and process.args:("/V:ON" and "/E:ON"))
188  )
189'''
190
191note = """## Triage and analysis
192
193#### Possible investigation steps
194
195- What execution path did the alert capture?
196  - Focus: child `process.executable` / `process.command_line`; web-parent `process.parent.name`, `process.parent.executable`, and `process.parent.command_line` for IIS/Apache/nginx/PHP CGI/Tomcat/ArcGIS.
197  - Implication: escalate when a web-facing parent launches a shell, script host, downloader, archive tool, or admin utility outside bounded tasks; lower only when parent context, child path, and command match one exact deployment, health-check, log rotation, or support task.
198- Is the child command administration or post-exploitation?
199  - Focus: `process.command_line`: WMIC, download cradles, archive creation, account/system discovery, service control, credential access, script-host flags, or web-root/temp/backup/app-content paths.
200  - Hint: for PowerShell, reconstruct script blocks by `host.id` and `process.pid` via `powershell.file.script_block_text`, `powershell.sequence`, and `powershell.total`; missing PowerShell telemetry is unresolved, not benign.
201  - Implication: escalate when the command stages payloads, runs discovery, creates accounts, changes services, or writes to web-accessible or temp paths; lower suspicion when bounded to one recognized deployment, health-check, log rotation, or support task.
202- Is user context human admin or service identity?
203  - Why: web-process children often inherit app-pool or service identity; `user.id`, `user.name`, and `user.domain` do not prove human initiation.
204  - Focus: `@timestamp`, `user.id`, `user.name`, `process.Ext.session_info.logon_type`, and `process.parent.command_line`.
205  - Implication: escalate when service or network logon context launches interactive troubleshooting, remote administration, or off-hours shell activity without a matching window; lower suspicion when identity, logon type, parent pool/service, and command scope fit one exact workflow.
206- Does child binary identity fit its command?
207  - Focus: `process.executable`, `process.pe.original_file_name`, `process.hash.sha256`, `process.code_signature.subject_name`, and `process.code_signature.trusted`.
208  - Implication: escalate when the child is renamed, unsigned/untrusted, user-writable, or mismatched to original file name; lower suspicion when identity and path match stable tooling, but continue because trusted binaries can carry web-shell commands.
209- Did file telemetry show web-shell placement, staging, or config changes?
210  - Focus: if file telemetry exists, review `host.id` file events for child `process.entity_id` or `process.pid`, checking `file.path`, `file.Ext.original.path`, and `file.Ext.windows.zone_identifier`. $investigate_1
211  - Hint: web-root script writes without later child starts are adjacent-variant evidence; if the child writes a script or executable, query starts where `process.executable` equals that path on same `host.id`.
212  - Implication: escalate when the child writes ASPX, ASP, PHP, JSP, JS, BAT, PS1, EXE, DLL, JAR, WAR, or archives to web-accessible/temp/user-writable paths, or a written artifact later executes; missing file telemetry is unresolved, not benign, and absence does not close.
213- Did the child launch second-stage processes?
214  - Focus: child starts on `host.id` where `process.parent.entity_id` equals child `process.entity_id`, checking `process.executable`, `process.command_line`, and `process.hash.sha256`. $investigate_2
215  - Implication: escalate when descendants include shells, script hosts, downloaders, archive tools, credential utilities, service control, or persistence tooling; absence only narrows impact when command, file, network, and related alerts also fit a benign workflow.
216- Did DNS/network telemetry show retrieval or control?
217  - Focus: if DNS/network telemetry exists, review child `process.entity_id` events on `host.id`, separating `dns.question.name` / `dns.resolved_ip` from `destination.ip` / `destination.port`; compare role with command intent. $investigate_3
218  - Hint: map DNS results to later connection IPs before linking query and connection; if a third-party alert lacks `process.entity_id`, recover the child by `host.id`, `process.pid`, and `@timestamp`. Missing network/DNS telemetry is unresolved, not benign.
219  - Implication: escalate when the child retrieves tools from public infrastructure, reaches rare/misaligned destinations, or connects outside web-server administration; decide from alert-local process evidence and corroboration when DNS/network telemetry is unavailable.
220- Do related alerts show broader compromise?
221  - Focus: same-web-parent starts and 48h `host.id` alerts for web-shell, credential-access, discovery, archive, lateral-movement, persistence, or anti-forensics.
222    - $investigate_4
223    - $investigate_0
224  - Implication: escalate scope when alerts cluster around the same server role, child command family, or staged artifacts; absence only narrows response scope when local parent-child, command, identity, file, and network evidence are explained.
225- What disposition fits?
226  - Implication: escalate on unexplained server-side execution, exploit-like command intent, suspicious child identity, payload staging, rare destinations, or broader compromise; do not wait for optional pivots when alert-local process evidence is unsafe. Close only when same-host alert-window telemetry proves one exact benign web-server workflow; use outside confirmation for legitimacy gaps. If evidence is mixed or visibility incomplete, preserve artifacts and escalate.
227
228### False positive analysis
229
230- Web deployment, post-install validation, health checks, vendor extension install, ArcGIS publishing, or maintenance can spawn "cmd.exe", PowerShell, or "wscript.exe" from web components. Confirm only when parent, child, command, service identity, and artifact/destination evidence describe the same alert-window workflow with no unexpected web-content writes, rare callbacks, or contradictions.
231- If telemetry proves shape but not legitimacy, require matching change, deployment, runbook, vendor, or owner confirmation; use prior occurrences post-closure to test exception stability.
232- Build exceptions from minimum confirmed pattern: web parent command, child executable/hash/signature, command line, `user.id`, `host.id`, and bounded content path or destination when decisive. Avoid parent name, `process.name`, or `host.id` alone.
233
234### Response and remediation
235
236- If confirmed benign, reverse temporary containment, document exact parent, child, command, service identity, artifact/destination evidence, and confirmation, and create exceptions only from that pattern.
237- If suspicious but unconfirmed, preserve the alert/export, process tree, child/parent entity IDs, command lines, hash, staged-file copies, destinations, related alerts, and web/app logs around `@timestamp` before containment or cleanup.
238- Apply reversible containment tied to evidence: block confirmed malicious destinations, restrict affected site/app access, disable exposed extension or virtual directory, or increase `host.id` monitoring. Isolate only when evidence and server criticality permit.
239- If confirmed malicious, contain the host or terminate the child only after preservation; if direct response is unavailable, escalate with process/artifact/destination/server-log evidence to the team that can contain the server, disable the exposed path, or stop the service.
240- Before deletion/restoration, hunt for the same hash, child command, staged path, domain, IP, and port across hosts/accounts. Then remove web shells, scripts, archives, scheduled tasks, dropped utilities, and persistence; restore known-good content/config; rotate exposed service, app, or admin credentials if secrets may be exposed.
241- After containment, patch the implicated app, extension, framework, or server component; review the internet-exposed site/service that launched the child; retain endpoint, network, and web logs; document script-only variants or logging gaps.
242"""
243
244setup = """## Setup
245
246This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
247
248Setup instructions: https://ela.st/install-elastic-defend
249
250### Additional data sources
251
252This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
253
254- [CrowdStrike](https://ela.st/crowdstrike-integration)
255- [Microsoft Defender XDR](https://ela.st/m365-defender)
256- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
257- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
258- [Windows Process Creation Logs](https://ela.st/audit-process-creation)
259"""
260
261[[rule.filters]]
262[rule.filters.meta]
263negate = true
264[rule.filters.query.wildcard."process.command_line"]
265case_insensitive = true
266value = "*?:\\\\Program Files\\\\*"
267
268[[rule.filters]]
269[rule.filters.meta]
270negate = true
271[rule.filters.query.wildcard."process.command_line"]
272case_insensitive = true
273value = "*?:\\\\Program Files (x86)\\\\*"
274
275[rule.investigation_fields]
276field_names = [
277    "@timestamp",
278    "host.name",
279    "host.id",
280    "user.id",
281    "process.entity_id",
282    "process.pid",
283    "process.executable",
284    "process.command_line",
285    "process.Ext.session_info.logon_type",
286    "process.pe.original_file_name",
287    "process.code_signature.subject_name",
288    "process.code_signature.trusted",
289    "process.hash.sha256",
290    "process.parent.executable",
291    "process.parent.command_line",
292]
293
294[transform]
295
296[[transform.investigate]]
297label = "Alerts associated with the host"
298description = ""
299providers = [
300  [
301    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
302    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
303  ]
304]
305relativeFrom = "now-48h/h"
306relativeTo = "now"
307
308[[transform.investigate]]
309label = "File events for the suspicious child process"
310description = ""
311providers = [
312  [
313    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" },
314    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
315    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
316  ],
317  [
318    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" },
319    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
320    { excluded = false, field = "process.pid", queryType = "phrase", value = "{{process.pid}}", valueType = "string" }
321  ]
322]
323relativeFrom = "now-1h"
324relativeTo = "now"
325
326[[transform.investigate]]
327label = "Child process events from the suspicious child"
328description = ""
329providers = [
330  [
331    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
332    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
333    { excluded = false, field = "process.parent.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
334  ]
335]
336relativeFrom = "now-1h"
337relativeTo = "now"
338
339[[transform.investigate]]
340label = "Network events for the suspicious child process"
341description = ""
342providers = [
343  [
344    { excluded = false, field = "event.category", queryType = "phrase", value = "network", valueType = "string" },
345    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
346    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
347  ],
348  [
349    { excluded = false, field = "event.category", queryType = "phrase", value = "network", valueType = "string" },
350    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
351    { excluded = false, field = "process.pid", queryType = "phrase", value = "{{process.pid}}", valueType = "string" }
352  ]
353]
354relativeFrom = "now-1h"
355relativeTo = "now"
356
357[[transform.investigate]]
358label = "Process events from the same web parent"
359description = ""
360providers = [
361  [
362    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
363    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
364    { excluded = false, field = "process.parent.entity_id", queryType = "phrase", value = "{{process.parent.entity_id}}", valueType = "string" }
365  ]
366]
367relativeFrom = "now-1h"
368relativeTo = "now"
369
370[rule.new_terms]
371field = "new_terms_fields"
372value = ["host.id", "process.command_line"]
373[[rule.new_terms.history_window_start]]
374field = "history_window_start"
375value = "now-7d"
376
377[[rule.threat]]
378framework = "MITRE ATT&CK"
379
380[[rule.threat.technique]]
381id = "T1505"
382name = "Server Software Component"
383reference = "https://attack.mitre.org/techniques/T1505/"
384
385[[rule.threat.technique.subtechnique]]
386id = "T1505.003"
387name = "Web Shell"
388reference = "https://attack.mitre.org/techniques/T1505/003/"
389
390[rule.threat.tactic]
391id = "TA0003"
392name = "Persistence"
393reference = "https://attack.mitre.org/tactics/TA0003/"
394
395[[rule.threat]]
396framework = "MITRE ATT&CK"
397
398[[rule.threat.technique]]
399id = "T1190"
400name = "Exploit Public-Facing Application"
401reference = "https://attack.mitre.org/techniques/T1190/"
402
403[rule.threat.tactic]
404id = "TA0001"
405name = "Initial Access"
406reference = "https://attack.mitre.org/tactics/TA0001/"
407
408[[rule.threat]]
409framework = "MITRE ATT&CK"
410
411[[rule.threat.technique]]
412id = "T1047"
413name = "Windows Management Instrumentation"
414reference = "https://attack.mitre.org/techniques/T1047/"
415
416[[rule.threat.technique]]
417id = "T1059"
418name = "Command and Scripting Interpreter"
419reference = "https://attack.mitre.org/techniques/T1059/"
420
421[[rule.threat.technique.subtechnique]]
422id = "T1059.001"
423name = "PowerShell"
424reference = "https://attack.mitre.org/techniques/T1059/001/"
425
426[[rule.threat.technique.subtechnique]]
427id = "T1059.003"
428name = "Windows Command Shell"
429reference = "https://attack.mitre.org/techniques/T1059/003/"
430
431[[rule.threat.technique.subtechnique]]
432id = "T1059.005"
433name = "Visual Basic"
434reference = "https://attack.mitre.org/techniques/T1059/005/"
435
436[[rule.threat.technique.subtechnique]]
437id = "T1059.007"
438name = "JavaScript"
439reference = "https://attack.mitre.org/techniques/T1059/007/"
440
441[rule.threat.tactic]
442id = "TA0002"
443name = "Execution"
444reference = "https://attack.mitre.org/tactics/TA0002/"