Query: write Sigma for Detects potentially suspicious processes being spawned by a web server process which could be the result of a successful
Matching passage: Sigma rule: Detects potentially suspicious processes being spawned by a web server process which could be the result of a successful. Logsource: windows / process_creation. Rule: title: Suspicious Process By Web Server Process id: 8202070f-edeb-4d31-a010-a26c72ac5600 status: test description: 'Detects potentially suspicious processes being spawned by a web server process which could be the result of a successfully placed web shell or exploitation ' references: - https://media.defense.gov/2020/Jun/09/2002313081/-1/-1/0/CSI-DETECT-AND-PREVENT-WEB-SHELL-MALWARE-20200422.PDF author: Thomas Patzke, Florian Roth (Nextron Systems), Zach Stanford @svch0st, Tim Shelton, Nasreddine Bencherchali (Nextron Systems) date: 2019-01-16 modified: 2024-11-26 tags: - attack.persistence - attack.initial-access - attack.t1505.003 - attack.t1190 logsource: category: process_creation product: windows detection: selection_webserver_image: ParentImage|endswith: - \caddy.exe - \httpd.exe - \nginx.exe - \php-cgi.exe - \php.exe - \tomcat.exe - \UMWorkerProcess.exe - \w3wp.exe - \ws_TomcatService.exe selection_webserver_characteristics_tomcat1: ParentImage|endswith: - \java.exe - \javaw.exe ParentImage|contains: - -tomcat- - \tomcat selection_webserver_characteristics_tomcat2: ParentImage|endswith: - \java.exe - \javaw.exe ParentCommandLine|contains: - CATALINA_HOME - catalina.home - catalina.jar selection_anomaly_children: Image|endswith: - \arp.exe - \at.exe - \bash.exe - \bitsadmin.exe - \certutil.exe - \cmd.exe - \cscript.exe - \dsget.exe - \hostname.exe - \nbtstat.exe - \net.exe - \net1.exe - \netdom.exe - \netsh.exe - \nltest.exe - \ntdsutil.exe - \powershell_ise.exe - \powershell.exe - \pwsh.exe - \qprocess.exe - \query.exe - \qwinsta.exe - \reg.exe - \rundll32.exe - \sc.exe - \sh.exe - \wmic.exe - \wscript.exe - \wusa.exe filter_main_fp_1: ParentImage|endswith: \java.exe CommandLine|endswith: Windows\system32\cmd.exe /c C:\ManageEngine\ADManager "Plus\ES\bin\elasticsearch.bat -Enode.name=RMP-NODE1 -pelasticsearch-pid.txt filter_main_fp_2: ParentImage|endswith: \java.exe CommandLine|contains|all: - sc query - ADManager Plus condition: 1 of selection_webserver_* and selection_anomaly_children and not 1 of filter_main_* falsepositives: - Particular web applications may spawn a shell process legitimately level: high
Near-miss passage: Sigma rule: Detects the usage of "reg.exe" to tamper with different Windows Defender registry keys in order to disable some importan. Logsource: windows / process_creation. Rule: title: Suspicious Windows Defender Registry Key Tampering Via Reg.EXE id: 452bce90-6fb0-43cc-97a5-affc283139b3 status: test description: 'Detects the usage of "reg.exe" to tamper with different Windows Defender registry keys in order to disable some important features related to protection and detection ' references: - https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/ - https://github.com/swagkarna/Defeat-Defender-V1.2.0/tree/ae4059c4276da6f6303b8f53cdff085ecae88a91 - https://www.elevenforum.com/t/video-guide-how-to-completely-disable-microsoft-defender-antivirus.14608/page-2 - https://tria.ge/241231-j9yatstqbm/behavioral1 author: Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems) date: 2022-03-22 modified: 2025-06-04 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_root_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_root_path: CommandLine|contains: - SOFTWARE\Microsoft\Windows Defender\ - SOFTWARE\Policies\Microsoft\Windows Defender Security Center - SOFTWARE\Policies\Microsoft\Windows Defender\ selection_dword_0: CommandLine|contains|all: - ' add ' - d 0 CommandLine|contains: - DisallowExploitProtectionOverride - EnableControlledFolderAccess - MpEnablePus - PUAProtection - SpynetReporting - SubmitSamplesConsent - TamperProtection selection_dword_1: CommandLine|contains|all: - ' add ' - d 1 CommandLine|contains: - DisableAccess - DisableAntiSpyware - DisableAntiSpywareRealtimeProtection - DisableAntiVirus - DisableAntiVirusSignatures - DisableArchiveScanning - DisableBehaviorMonitoring - DisableBlockAtFirstSeen - DisableCloudProtection - DisableConfig - DisableEnhancedNotifications - DisableIntrusionPreventionSystem - DisableIOAVProtection - DisableNetworkProtection - DisableOnAccessProtection - DisablePrivacyMode - DisableRealtimeMonitoring - DisableRoutinelyTakingAction - DisableScanOnRealtimeEnable - DisableScriptScanning - DisableSecurityCenter - Notification_Suppress - SignatureDisableUpdateOnStartupWithoutEngine condition: all of selection_root_* and 1 of selection_dword_* falsepositives: - Rare legitimate use by administrators to test software (should always be investigated) level: high