Network-facing service spawning a shell or scripting interpreter

Siemphony@siemphonyhighT1210unverifiedPlaybook · Unexpected execution

MITRE's Windows analytic for exploitation of remote services correlates inbound traffic to a service port with the service crashing or restarting and with unexpected child processes appearing under it. The inbound-to-crash join, the ServicePortSet and the failed-connection rate are all correlation and threshold conditions Sigma has no way to state, so this rule takes the child process leg on its own: a listening service — IIS worker, database engine, print spooler, DNS server, web server — creating a command shell, a scripting interpreter or a download utility. A daemon that serves requests has no ordinary reason to launch an interactive shell, which makes this the strongest single event in the chain even without the crash that usually precedes it. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0118, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Network-facing service spawning a shell or scripting interpreter2id: 60dea374-d7c3-4a7d-bf9f-8daab3d263e63status: experimental4description: |5  MITRE's Windows analytic for exploitation of remote services correlates6  inbound traffic to a service port with the service crashing or restarting and7  with unexpected child processes appearing under it. The inbound-to-crash join,8  the ServicePortSet and the failed-connection rate are all correlation and9  threshold conditions Sigma has no way to state, so this rule takes the child10  process leg on its own: a listening service — IIS worker, database engine,11  print spooler, DNS server, web server — creating a command shell, a scripting12  interpreter or a download utility. A daemon that serves requests has no13  ordinary reason to launch an interactive shell, which makes this the strongest14  single event in the chain even without the crash that usually precedes it.15  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0118, not hand-written and not tested by its author. Any lab result is on this rule's own page.16references:17  - https://attack.mitre.org/techniques/T121018  - https://attack.mitre.org/detectionstrategies/DET011819author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)20date: 2026-08-1621tags:22  - attack.lateral-movement23  - attack.t121024logsource:25  category: process_creation26  product: windows27detection:28  selection_service_parent:29    ParentImage|endswith:30      - '\w3wp.exe'31      - '\httpd.exe'32      - '\nginx.exe'33      - '\tomcat9.exe'34      - '\tomcat10.exe'35      - '\sqlservr.exe'36      - '\mysqld.exe'37      - '\postgres.exe'38      - '\spoolsv.exe'39      - '\dns.exe'40      - '\sshd.exe'41  selection_shell_child:42    Image|endswith:43      - '\cmd.exe'44      - '\powershell.exe'45      - '\pwsh.exe'46      - '\wscript.exe'47      - '\cscript.exe'48      - '\mshta.exe'49      - '\bitsadmin.exe'50      - '\certutil.exe'51      - '\curl.exe'52      - '\net.exe'53      - '\net1.exe'54  condition: selection_service_parent and selection_shell_child55falsepositives:56  - "Web applications that legitimately shell out — an intranet admin page calling cmd.exe, a reporting feature invoking a batch job, or a deployment hook run by the IIS worker. This is the main source of noise and it is per-application, so the exclusion belongs on the specific site or application pool rather than on w3wp.exe as a whole."57  - "Database maintenance that uses xp_cmdshell or an SQL Agent job step of type CmdExec, which appears as sqlservr.exe launching cmd.exe on a schedule."58  - "Printer driver installation and spooler-hosted vendor components, where spoolsv.exe runs a helper script during driver setup — the same parent-child shape that print-spooler exploitation produces."59  - "OpenSSH server sessions on hosts where sshd is a supported administration path, since every interactive logon spawns a shell from sshd.exe and those hosts need excluding by name before this rule is usable. MITRE's AllowedAdminCIDRs knob is the equivalent suppression on the network side, which this rule cannot apply because the source address is not on the process event."60level: high

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((InitiatingProcessFolderPath endswith "\\w3wp.exe" or InitiatingProcessFolderPath endswith "\\httpd.exe" or InitiatingProcessFolderPath endswith "\\nginx.exe" or InitiatingProcessFolderPath endswith "\\tomcat9.exe" or InitiatingProcessFolderPath endswith "\\tomcat10.exe" or InitiatingProcessFolderPath endswith "\\sqlservr.exe" or InitiatingProcessFolderPath endswith "\\mysqld.exe" or InitiatingProcessFolderPath endswith "\\postgres.exe" or InitiatingProcessFolderPath endswith "\\spoolsv.exe" or InitiatingProcessFolderPath endswith "\\dns.exe" or InitiatingProcessFolderPath endswith "\\sshd.exe") and (FolderPath endswith "\\cmd.exe" or FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe" or FolderPath endswith "\\wscript.exe" or FolderPath endswith "\\cscript.exe" or FolderPath endswith "\\mshta.exe" or FolderPath endswith "\\bitsadmin.exe" or FolderPath endswith "\\certutil.exe" or FolderPath endswith "\\curl.exe" or FolderPath endswith "\\net.exe" or FolderPath endswith "\\net1.exe"))

Splunk · SPL

Run this as a search.

index=* ((ParentImage="*\\w3wp.exe" OR ParentImage="*\\httpd.exe" OR ParentImage="*\\nginx.exe" OR ParentImage="*\\tomcat9.exe" OR ParentImage="*\\tomcat10.exe" OR ParentImage="*\\sqlservr.exe" OR ParentImage="*\\mysqld.exe" OR ParentImage="*\\postgres.exe" OR ParentImage="*\\spoolsv.exe" OR ParentImage="*\\dns.exe" OR ParentImage="*\\sshd.exe") AND (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\bitsadmin.exe" OR Image="*\\certutil.exe" OR Image="*\\curl.exe" OR Image="*\\net.exe" OR Image="*\\net1.exe"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.parent.executable) LIKE "*\\\\w3wp.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\httpd.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\nginx.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\tomcat9.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\tomcat10.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\sqlservr.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\mysqld.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\postgres.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\spoolsv.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\dns.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\sshd.exe") AND (TO_LOWER(process.executable) LIKE "*\\\\cmd.exe" OR TO_LOWER(process.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pwsh.exe" OR TO_LOWER(process.executable) LIKE "*\\\\wscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\cscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\mshta.exe" OR TO_LOWER(process.executable) LIKE "*\\\\bitsadmin.exe" OR TO_LOWER(process.executable) LIKE "*\\\\certutil.exe" OR TO_LOWER(process.executable) LIKE "*\\\\curl.exe" OR TO_LOWER(process.executable) LIKE "*\\\\net.exe" OR TO_LOWER(process.executable) LIKE "*\\\\net1.exe"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="ParentImage" type="pcre2">(?i)(\\w3wp\.exe$|\\httpd\.exe$|\\nginx\.exe$|\\tomcat9\.exe$|\\tomcat10\.exe$|\\sqlservr\.exe$|\\mysqld\.exe$|\\postgres\.exe$|\\spoolsv\.exe$|\\dns\.exe$|\\sshd\.exe$)</field>    <field name="Image" type="pcre2">(?i)(\\cmd\.exe$|\\powershell\.exe$|\\pwsh\.exe$|\\wscript\.exe$|\\cscript\.exe$|\\mshta\.exe$|\\bitsadmin\.exe$|\\certutil\.exe$|\\curl\.exe$|\\net\.exe$|\\net1\.exe$)</field>    <description>Network-facing service spawning a shell or scripting interpreter</description>    <mitre>      <id>T1210</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: high
Category: exploitation_initial_access
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 60dea374-d7c3-4a7d-bf9f-8daab3d263e6

ATT&CKT1210

T1210Exploitation of Remote Services

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1210, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Remove sshd.exe before deployment; add it back only on hosts where SSH is not
Exclude Exchange servers, or their Managed Availability probe paths, by name.
Exclude noisy web apps at the site or application-pool level, not by dropping
Drop net.exe and net1.exe. They are discovery (T1087/T1018), they widen the
MITRE's AllowedAdminCIDRs knob is the intended suppression and cannot be
Decide consciously whether to add wsmprovhost.exe, services.exe and

Declared by the author

Web applications that legitimately shell out — an intranet admin page calling cmd.exe, a reporting feature invoking a batch job, or a deployment hook run by the IIS worker. This is the main source of noise and it is per-application, so the exclusion belongs on the specific site or application pool rather than on w3wp.exe as a whole.
Database maintenance that uses xp_cmdshell or an SQL Agent job step of type CmdExec, which appears as sqlservr.exe launching cmd.exe on a schedule.
Printer driver installation and spooler-hosted vendor components, where spoolsv.exe runs a helper script during driver setup — the same parent-child shape that print-spooler exploitation produces.
OpenSSH server sessions on hosts where sshd is a supported administration path, since every interactive logon spawns a shell from sshd.exe and those hosts need excluding by name before this rule is usable. MITRE's AllowedAdminCIDRs knob is the equivalent suppression on the network side, which this rule cannot apply because the source address is not on the process event.

Lessonexploitation initial access

exploitation initial accessAI draft — unreviewed

01 · What this rule detects

A listening network service creating a command shell, a scripting interpreter or a download utility as a child process. MITRE's AN0327 is a three-part chain: inbound traffic to a service port, then near-time instability in that service (crash or restart, System EventID 1000), then unexpected child processes under it. The rule takes the third link alone, because the first two are joins across events and Sigma has no join. That trade changes what the alert means: without the crash, w3wp.exe → cmd.exe is not evidence of exploitation, it is evidence that a web application shelled out. The crash is what makes this T1210 rather than an ordinary web-shell finding, and the crash is the part that did not make it into the YAML. A hit is a lead, not a conclusion.

02 · Telemetry you need

Sysmon EventID 1 (or Security 4688) with ParentImage populated. The whole rule
Coverage on servers — the parents are IIS workers, database engines and the
To recover MITRE's chain later: the System channel for EventID 1000.

03 · How the logic works

Two selections, AND-ed — a parent set and a child set:

Neither list alone is a detection. cmd.exe starting is among the most common events in Windows; w3wp.exe starting is routine. The signal is entirely in the pair — a daemon that serves requests launched an interactive shell — and the AND is what carries it. It is also why all four backends render: the OR stays inside each field rather than spanning fields, which is the construction that makes Wazuh refuse a rule. endswith with a leading \, for the usual reason: services run from Program Files, from versioned install directories, from wherever the vendor put them, and a full path would pin you to one deployment. The separator prevents notcmd.exe matching. Now read the parent list against MITRE. AN0327's ServicePortSet is 445, 135, 3389, 5985, 5986, 1433, 3306. This list covers 1433 (sqlservr.exe) and 3306 (mysqld.exe) and nothing else — the processes hosting SMB/RPC (services.exe, svchost.exe), RDP and WinRM (wsmprovhost.exe) are absent. What it is heavy on instead, w3wp.exe/httpd.exe/nginx.exe/tomcat9, is the canonical web-shell shape, which is T1190 and T1505.003 under Initial Access. Trace it both ways: a WinRM exploit landing cmd.exe under wsmprovhost.exe produces nothing here, while an IIS web shell running whoami fires and gets tagged attack.lateral-movement. The tag is doing work the logic does not support. \dns.exe is a very generic filename, so any third-party binary called dns.exe becomes a monitored service parent for free.

04 · Common false positives

`\sshd.exe` in the parent list means every interactive OpenSSH logon matches.
On-premises Exchange, which the reviewer flagged as the highest-volume
Web applications that legitimately shell out — an admin page, a reporting
xp_cmdshell and SQL Agent CmdExec job steps: sqlservr.exe → cmd.exe on a
Printer driver installation, where spoolsv.exe runs a vendor helper script —

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from MITRE ATT&CK DET0118 and never executed against a log line. level: high reflects how strong the parent-child pair looks in the abstract; it is not a measured false-positive rate, and with sshd.exe included it is very likely wrong for your estate.
tier_2: run it over historical process-creation data on servers only, and turn the top talkers — Exchange, sshd, your admin web apps — into named exclusions.
tier_3: restores MITRE's chain: the child process joined to a System EventID 1000 crash inside the 10-minute TimeWindow, which is what would let you call a hit exploitation. Note the evasion floor too: an in-process payload (reflective loader, ISAPI module, SQL CLR assembly), or any binary outside the eleven-name child list, never appears here at all.

Related detections6 nearby

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/60dea374-d7c3-4a7d-bf9f-8daab3d263e6

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Network-facing service spawning a shell or scripting interpreter

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it