Server application process spawns a command interpreter

Siemphony@siemphonymediumT1505unverified

AN1507 describes server modules that "later execute command-line interpreters", and that hand-off is the one thing observable at the parent level: whichever extensibility feature was abused — an IIS native module or ISAPI filter, a web shell page, an Apache module, or a SQL stored procedure calling xp_cmdshell — the server worker process itself ends up as the parent of a shell, and a single Sysmon EventID 1 record carries both halves of that. MITRE supplies the `ParentProcessName` knob; the five server workers matched here are authored, and java.exe and the Tomcat service wrappers are deliberately left out of it, because a JVM parent spawning cmd.exe is ordinary in build, CI and application-server work and would swamp the rule. The analytic's other log source, Security EventID 4698, is not used at all: scheduled-job creation carries a task name and task XML and has no field that can express a module being installed, so a rule written against it would render in four backends and match nothing. Being the parent technique's rule it necessarily overlaps T1505.001, T1505.003 and T1505.004 — at this level of ATT&CK there is no observable that is "server software component" in general rather than one of its children. The installation step, and MITRE's `TimeWindow` knob between install and execution, are a cross-event correlation lib/sigma cannot express, so this sees the payoff and never the plant. One vocabulary note: the rule is written in the Sysmon EventID 1 field names the brief's process_creation logsource implies; if the same category is fed from Security 4688 instead, the names are `NewProcessName` and `ParentProcessName` and the feed needs a field mapping first, plus *Audit Process Creation* and the separate *Include command line in process creation events* policy. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0547, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((InitiatingProcessFolderPath endswith "\\w3wp.exe" or InitiatingProcessFolderPath endswith "\\php-cgi.exe" or InitiatingProcessFolderPath endswith "\\httpd.exe" or InitiatingProcessFolderPath endswith "\\nginx.exe" or InitiatingProcessFolderPath endswith "\\sqlservr.exe") and (FolderPath endswith "\\cmd.exe" or FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe" or FolderPath endswith "\\cscript.exe" or FolderPath endswith "\\wscript.exe" or FolderPath endswith "\\mshta.exe" or FolderPath endswith "\\bash.exe" or FolderPath endswith "\\wsl.exe"))

Splunk · SPL

Run this as a search.

index=* ((ParentImage="*\\w3wp.exe" OR ParentImage="*\\php-cgi.exe" OR ParentImage="*\\httpd.exe" OR ParentImage="*\\nginx.exe" OR ParentImage="*\\sqlservr.exe") AND (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\cscript.exe" OR Image="*\\wscript.exe" OR Image="*\\mshta.exe" OR Image="*\\bash.exe" OR Image="*\\wsl.exe"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.parent.executable) LIKE "*\\\\w3wp.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\php-cgi.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\httpd.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\nginx.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\sqlservr.exe") AND (TO_LOWER(process.executable) LIKE "*\\\\cmd.exe" OR TO_LOWER(process.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pwsh.exe" OR TO_LOWER(process.executable) LIKE "*\\\\cscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\wscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\mshta.exe" OR TO_LOWER(process.executable) LIKE "*\\\\bash.exe" OR TO_LOWER(process.executable) LIKE "*\\\\wsl.exe"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="ParentImage" type="pcre2">(?i)(\\w3wp\.exe$|\\php-cgi\.exe$|\\httpd\.exe$|\\nginx\.exe$|\\sqlservr\.exe$)</field>    <field name="Image" type="pcre2">(?i)(\\cmd\.exe$|\\powershell\.exe$|\\pwsh\.exe$|\\cscript\.exe$|\\wscript\.exe$|\\mshta\.exe$|\\bash\.exe$|\\wsl\.exe$)</field>    <description>Server application process spawns a command interpreter</description>    <mitre>      <id>T1505</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: registry_persistence
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 603e77d1-3d76-40e1-8418-83b4ae26bdd5

ATT&CKT1505

T1505Server Software Component

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonregistry persistence

registry persistenceAI draft — unreviewed

01 · What this rule detects

AN1507 describes server modules "that later execute command-line interpreters". The install step is invisible on the log sources the brief offers, so this rule takes only the second half: a Windows server worker process becoming the parent of a shell. A single Sysmon EventID 1 record carries both sides of that hand-off, which is why one selection pair is enough. Be clear what a hit means. Every leg here is really a child's mechanism — w3wp.exe or php-cgi.exe spawning cmd.exe is the canonical web shell observable (T1505.003), and sqlservr.exe doing it is xp_cmdshell abuse (T1505.001, already published here). A learner who sees this alert is looking at a web shell, not "server software component" in the abstract. At parent level there is no observable that is anything else.

02 · Telemetry you need

category: process_creation, product: windows, copied verbatim from AN1507. The rule is written in Sysmon EventID 1 vocabulary (Image, ParentImage). Sysmon is a separate download no Windows install ships, and ParentImage exists only once it is deployed with ProcessCreate not excluded by config. A stock server returns zero rows, and zero rows reads as quiet when it means blind.
If the same category is fed from Security 4688 instead, the field names are NewProcessName and ParentProcessName, so that feed needs a mapping first — plus Audit Process Creation and the separate Include command line in process creation events policy.
AN1507's other source, Security EventID 4698, went unused: scheduled-job creation has no field that can express a module being installed.

03 · How the logic works

Two selections, ANDed. selection_server_parent is ParentImage|endswith over five server workers: \w3wp.exe, \php-cgi.exe, \httpd.exe, \nginx.exe, \sqlservr.exe. MITRE supplies the ParentProcessName knob; those five values are the pipeline's own. The leading backslash anchors at a filename boundary instead of matching any path containing the string. selection_interpreter is Image|endswith over eight interpreters — cmd, powershell, pwsh, cscript, wscript, mshta, bash, wsl. java.exe and the Tomcat service wrappers are deliberately absent: a JVM parent spawning cmd.exe is ordinary in build and CI work and would swamp the rule. Two defects to fix before deploying. \nginx.exe can never fire — nginx has no exec support and forks nothing but its own workers, and the only Windows nginx route to a shell is php-cgi.exe, already listed. It widens apparent coverage and matches nothing. And \sqlservr.exe is a strict subset of the published T1505.001 selection, so it guarantees paired alerts for zero new coverage. MITRE's TimeWindow knob — the delay between install and execution — is a cross-event correlation lib/sigma cannot express. This rule sees the payoff and never the plant.

04 · Common false positives

Line-of-business ASP.NET applications that shell out on purpose: a page driving a PDF or image converter through cmd.exe, a legacy batch job behind a web front end, housekeeping that clears temporary files. This is the loudest source by a wide margin and the only one that recurs at request rate, which is why the level is medium rather than high.
Behind it: xp_cmdshell in ETL and BCP work; Web Deploy post-synchronisation and warm-up scripts during release windows; monitoring and backup agents polling host state with a short cmd.exe probe.

05 · Detection maturity

tier_1: , and it cannot be otherwise: derived from a MITRE scaffold with no query logic, never executed against a log line. Reasoning on paper that a web shell would land in this selection is analysis, not verification.
tier_2: is running it read-only, ranking hits by parent-and-child pair, and turning the top of that list into the exclusion block the rule lacks.
tier_3: ** is joining it to the installation event across MITRE's TimeWindow, so the alert means persistence rather than an application doing its job.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Baseline ParentCommandLine for a fortnight and exclude the applications that
Remove \nginx.exe; add \php.exe where PHP runs outside FastCGI.
Add renamed or custom server wrappers — that is what MITRE's
Revisit for retirement once T1505.003 has a rule of its own.

Declared by the author

Line-of-business ASP.NET applications that shell out on purpose — a page that drives a PDF or image converter through cmd.exe, a legacy batch job wrapped in a web front end, or housekeeping code that shells out to clear temporary files. This is the loudest source by a wide margin and the only one that can recur at request rate, which is why the level is medium; on an estate where no application does this the rule is close to silent and would justify a higher level once the exception list has been built from ParentCommandLine.
Scheduled maintenance and ETL work that uses xp_cmdshell from sqlservr.exe, such as bulk-load staging, BCP export wrappers, directory listings before a file import, and backup-file rotation. On any estate where xp_cmdshell is enabled this is a predictable recurring hit under the SQL Server service account at fixed times.
Web-deployment and release tooling running inside the worker process, including Web Deploy post-synchronisation commands and application-warmup or cache-priming scripts that invoke powershell.exe from w3wp.exe during a deployment window.
Monitoring, APM and backup agents that launch a short cmd.exe or powershell.exe probe from the worker process to collect host or application state on a polling interval, producing a steady low-rate match under a service account.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1505, evaluated against their process_creation events.

Share this rule

/u/siemphony/603e77d1-3d76-40e1-8418-83b4ae26bdd5

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Server application process spawns a command interpreter

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it