
title: Execution in Webserver Root Folder
author: Florian Roth
date: 2019/01/16
description: Detects a suspicious program execution in a web service root folder (filter
  out false positives)
detection:
  SELECTION_1:
    EventID: 1
  SELECTION_2:
    Image:
    - '*\wwwroot\\*'
    - '*\wmpub\\*'
    - '*\htdocs\\*'
  SELECTION_3:
    Image:
    - '*bin\\*'
    - '*\Tools\\*'
    - '*\SMSComponent\\*'
  SELECTION_4:
    ParentImage:
    - '*\services.exe'
  condition: (SELECTION_1 and SELECTION_2 and  not (SELECTION_3 and SELECTION_4))
falsepositives:
- Various applications
- Tools that include ping or nslookup command invocations
fields:
- CommandLine
- ParentCommandLine
id: 35efb964-e6a5-47ad-bbcd-19661854018d
level: medium
logsource:
  category: process_creation
  product: windows
status: experimental
tags:
- attack.persistence
- attack.t1505.003
- attack.t1100
ruletype: SIGMA
