Web server worker writes a server-side script into a web root

1title: Web server worker writes a server-side script into a web root2id: d1d48dd0-d5c7-4642-969d-4cae6a9057ca3status: experimental4description: |5  AN1108 has two halves — an unexpected file appearing in a web directory, and6  the server worker later spawning a shell — and this rule takes the first. The7  second is already published in this corpus as the T1505 parent's rule,8  which matches w3wp.exe, php-cgi.exe, httpd.exe, nginx.exe and sqlservr.exe9  spawning an interpreter and whose own description says it "sees the payoff and10  never the plant". This rule is the plant, so the two are complementary rather11  than duplicates. It requires all three of: a Sysmon EventID 11 file-create12  whose creating process is a web server worker, a target path inside a web13  directory, and a server-side script extension. The creator gate is what makes14  the rule worth running — a release pipeline, an administrator copying files or15  a package installer writes into the same directories with the same extensions,16  and none of them is w3wp.exe or php-cgi.exe, whereas an exploited web17  application writing its own backdoor is the worker process itself, which is the18  shape ProxyLogon-class web shell drops take. The path list is MITRE's19  `WebRootPath` knob, populated here with the default IIS layout plus the20  htdocs/httpdocs/public_html/webapps conventions third-party stacks use; the21  extension list and the process list are authored, not sourced from MITRE, whose22  `ParentProcess` knob describes the process-creation leg rather than this one.23  Three limits are structural, and the first is the one that decides whether this24  rule ever fires. Sysmon's own sample configurations filter FileCreate hard —25  the widely used ones include only a handful of extensions and directories — so26  on a stock deployment this rule returns zero rows not because nothing was27  dropped but because the event was never generated; the config must include28  FileCreate for the web roots and script extensions below before the rule means29  anything, and zero rows reads as quiet when it actually means blind. Second,30  the rule only sees shells the web server itself wrote: a shell copied in over31  SMB, unpacked by an installer, or written by an out-of-process ASP.NET Core32  application (the writer there is dotnet.exe or the application's own binary,33  neither of which is matched) is invisible here. Third, a JSP shell dropped34  through a servlet container is written by java.exe rather than by the35  tomcat9.exe service wrapper, and java.exe is deliberately left out of the36  creator list because it would match every build, IDE and CI job on the estate —37  so the Java arm of this technique is uncovered.38  What is not attempted: the analytic's Security 4624/4648 log source, because a39  logon record carries no file path and no process lineage and cannot express a40  web shell at all; MITRE's `PayloadEntropyThreshold` and `TimeWindow` knobs,41  which are a content measure and a cross-event correlation that lib/sigma models42  neither of; and the Linux and macOS analytics — AN1109's process leg (apache243  or nginx spawning a shell) is already published as this corpus's T1059.00444  rule, its file leg needs auditd watches on the web root that no distribution45  loads by default, and AN1110's macos/unifiedlog source has no field vocabulary46  in the brief, in lib/sigma or in Sigma's taxonomy. Vocabulary note: this rule47  is written in the Sysmon EventID 11 names `Image` and `TargetFilename` that the48  brief's `file_event` logsource implies. An estate feeding the same category49  from Security 4663 instead has `ProcessName` and `ObjectName` and needs a field50  mapping before any of this matches — configuring *Audit Object Access* and a51  SACL without that mapping buys nothing here.52  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0394, not hand-written and not tested by its author. Any lab result is on this rule's own page.53references:54  - https://attack.mitre.org/techniques/T1505/00355  - https://attack.mitre.org/detectionstrategies/DET039456author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)57date: 2026-08-1658tags:59  - attack.persistence60  - attack.t1505.00361logsource:62  category: file_event63  product: windows64detection:65  selection_server_writer:66    Image|endswith:67      - '\w3wp.exe'68      - '\php-cgi.exe'69      - '\php.exe'70      - '\httpd.exe'71      - '\nginx.exe'72  selection_web_directory:73    TargetFilename|contains:74      - '\inetpub\'75      - '\wwwroot\'76      - '\htdocs\'77      - '\httpdocs\'78      - '\public_html\'79      - '\webapps\'80      - '\www\'81  selection_script_extension:82    TargetFilename|endswith:83      - '.asp'84      - '.aspx'85      - '.ashx'86      - '.asmx'87      - '.asax'88      - '.cshtml'89      - '.vbhtml'90      - '.php'91      - '.php3'92      - '.php4'93      - '.php5'94      - '.php7'95      - '.phtml'96      - '.jsp'97      - '.jspx'98      - '.jspf'99      - '.cfm'100      - '.cfml'101  condition: all of selection_*102falsepositives:103  - "Content management systems updating themselves. A WordPress, Joomla, Drupal or PrestaShop core or plugin update on a Windows PHP host is php-cgi.exe writing dozens of .php files into public_html or wwwroot in one burst, which is this rule's exact selection with nothing distinguishing it. On a CMS host this is the highest-volume match by a wide margin and is why the level is medium rather than high."104  - "Deployment features that run inside the worker process rather than beside it. Web Deploy handled by the IIS management service, an application's own self-update or plugin installer, and CMS theme or template editors that save a page from the browser all write server-side script files as w3wp.exe during ordinary release and administration work."105  - "Applications that generate script files as a feature: page builders and template editors that persist user-authored .php or .cshtml, report and form designers that emit an .aspx per saved definition, and caching layers that write compiled template output back into the web directory."106  - "File-upload endpoints that store user content under the web root without rewriting the extension, where an uploaded document simply happens to end in one of these suffixes. The write is benign and the file is never requested, but the event is identical to a shell being placed."107  - "Restore and migration work performed through the web tier, such as a site-migration or backup plugin unpacking an archive of the site's own pages back into place under the worker process account."108level: medium