title: Windows Webshell Creation
id: 39f1f9f2-9636-45de-98f6-a4046aa8e4b9
status: test
description: Possible webshell file creation on a static web site
author: Beyu Denis, oscd.community, Tim Shelton
references:
  - PT ESC rule and personal experience
date: 2019/10/22
modified: 2022/05/24
logsource:
  product: windows
  category: file_event
detection:
  selection_2:
    TargetFilename|contains: '\inetpub\wwwroot\'
  selection_3:
    TargetFilename|contains:
      - '.asp'
      - '.ashx'
      - '.ph'
  selection_4:
    TargetFilename|contains:
      - '\www\'
      - '\htdocs\'
      - '\html\'
  selection_5:
    TargetFilename|contains: '.ph'
  selection_6:
    - TargetFilename|endswith: '.jsp'
    - TargetFilename|contains|all:
      - '\cgi-bin\'
      - '.pl'
  false_positive1:    # false positives when unpacking some executables in $TEMP
    TargetFilename|contains:
      - '\AppData\Local\Temp\'
      - '\Windows\Temp\'
  false_positive2:
    Image: 'System' # fp : backup/restore from drivers
  condition: (selection_2 and selection_3 and not false_positive1) or (selection_4 and selection_5 and not false_positive1) or (selection_6 and not false_positive1) and not false_positive2
falsepositives:
  - Legitimate administrator or developer creating legitimate executable files in a web application folder
level: high
tags:
  - attack.persistence
  - attack.t1505.003
