Detect Shared Webroot in Sumo Logic CSE
Adversaries may add malicious content to an internally accessible website through an open network file share that contains the website's webroot or web content directory. By writing a malicious script (PHP, ASPX, JSP, etc.) to the shared webroot and then browsing to it, the adversary causes the web server process to execute the content — typically resulting in a webshell. This technique enables lateral movement to the system running the web server, as the code runs under the web server process context (IIS, Apache, nginx) which may have local system or administrative privileges. The attack chain: (1) discover open share pointing to webroot, (2) write malicious web script via SMB, (3) trigger execution via HTTP request. This technique has been deprecated by MITRE but the underlying behavior remains operationally relevant as a webshell deployment vector.
MITRE ATT&CK
- Tactic
- Lateral Movement
- Canonical reference
- https://attack.mitre.org/techniques/T1051/
Sumo Detection Query
(_sourceCategory=*windows* OR _sourceCategory=*sysmon* OR _sourceCategory=*wineventlog*)
| parse regex "(?:EventCode|EventID)\s*=\s*(?P<EventCode>\d+)" nodrop
| parse regex "TargetFilename\s*=\s*(?P<TargetFilename>[^\n\r]+)" nodrop
| parse regex "Image\s*=\s*(?P<Image>[^\n\r]+)" nodrop
| parse regex "ParentImage\s*=\s*(?P<ParentImage>[^\n\r]+)" nodrop
| parse regex "CommandLine\s*=\s*(?P<CommandLine>[^\n\r]+)" nodrop
| parse regex "ShareName\s*=\s*(?P<ShareName>[^\n\r]+)" nodrop
| parse regex "(?:User|SubjectUserName)\s*=\s*(?P<Actor>[^\n\r]+)" nodrop
| where
(
EventCode = "11"
AND (
TargetFilename matches "*\\inetpub\\wwwroot\\*"
OR TargetFilename matches "*\\xampp\\htdocs\\*"
OR TargetFilename matches "*\\wamp\\www\\*"
OR TargetFilename matches "*\\Apache24\\htdocs\\*"
OR TargetFilename matches "*\\nginx\\html\\*"
OR TargetFilename matches "*\\tomcat\\webapps\\*"
OR TargetFilename matches "*\\www\\html\\*"
)
AND (
TargetFilename matches "*.php"
OR TargetFilename matches "*.php5"
OR TargetFilename matches "*.phtml"
OR TargetFilename matches "*.asp"
OR TargetFilename matches "*.aspx"
OR TargetFilename matches "*.ashx"
OR TargetFilename matches "*.jsp"
OR TargetFilename matches "*.jspx"
OR TargetFilename matches "*.cfm"
OR TargetFilename matches "*.cgi"
OR TargetFilename matches "*.shtml"
)
)
OR
(
EventCode = "1"
AND (
ParentImage matches "*w3wp.exe*"
OR ParentImage matches "*httpd.exe*"
OR ParentImage matches "*nginx.exe*"
OR ParentImage matches "*php-cgi.exe*"
OR ParentImage matches "*java.exe*"
OR ParentImage matches "*iisexpress.exe*"
OR ParentImage matches "*tomcat*.exe*"
)
AND (
Image matches "*\\cmd.exe*"
OR Image matches "*\\powershell.exe*"
OR Image matches "*\\pwsh.exe*"
OR Image matches "*\\wscript.exe*"
OR Image matches "*\\cscript.exe*"
OR Image matches "*\\mshta.exe*"
OR Image matches "*\\whoami.exe*"
OR Image matches "*\\ipconfig.exe*"
OR Image matches "*\\systeminfo.exe*"
OR Image matches "*\\nltest.exe*"
OR Image matches "*\\certutil.exe*"
OR Image matches "*\\bitsadmin.exe*"
OR Image matches "*\\net.exe*"
OR Image matches "*\\net1.exe*"
)
)
OR
(
EventCode = "5140"
AND (
ShareName matches "*wwwroot*"
OR ShareName matches "*htdocs*"
OR ShareName matches "*webroot*"
OR ShareName matches "*webapps*"
)
)
| eval DetectionBranch = if(EventCode = "11", "WebRootFileDrop",
if(EventCode = "1", "WebShellChildProcess",
if(EventCode = "5140", "WebRootShareAccess", "Unknown")))
| fields _messageTime, _sourceHost, Actor, DetectionBranch, TargetFilename, Image, ParentImage, CommandLine, ShareName
| sort by _messageTime descThree-branch Sumo Logic detection for T1051 Shared Webroot, parsing raw Sysmon and Windows Security Event logs forwarded via Sumo Logic Installed Collector. Uses regex parsing to extract key fields from Sysmon EventID 11 (file create in webroot), EventID 1 (web server spawning suspicious child), and Windows Security EventID 5140 (SMB share access to webroot share names). Compatible with both XML-formatted Sysmon events and flat key=value formats. Adjust the _sourceCategory filter to match your organization's Sumo Logic source category taxonomy for Windows/Sysmon log sources.
Data Sources
Required Tables
False Positives & Tuning
- Deployment automation (Octopus Deploy, Ansible WinRM) writing web application files to IIS or Apache webroot directories from service accounts — whitelist known deployer account names and source hosts in the Actor and _sourceHost fields
- CMS platforms (WordPress, Drupal) with auto-update enabled cause the PHP-FPM or web server process to write updated plugin .php files, generating EventID 11 hits — consider excluding known CMS update parent processes and expected plugin paths
- SharePoint and IIS application pools regularly access SMB shares named 'wwwroot' as part of normal content serving — EventID 5140 triggers on any share read, not just writes; enrich with EventID 4663 write accesses to distinguish reconnaissance from actual file drops
Other platforms for T1051
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Drop PHP Webshell via SMB Network Share to Webroot
Expected signal: Windows Security Event ID 5140: Network share \\TARGET_WEBSERVER\wwwroot accessed from source workstation. Windows Security Event ID 4624: Network logon (Type 3) to TARGET_WEBSERVER using webadmin credentials. Sysmon Event ID 11 on TARGET_WEBSERVER: FileCreate for df00tech-test-shell.php in C:\inetpub\wwwroot\, InitiatingProcess will be System (SMB kernel write). DeviceFileEvents on TARGET_WEBSERVER: FileCreated for df00tech-test-shell.php with folder path containing wwwroot.
- Test 2Trigger Webshell Execution via HTTP GET Request
Expected signal: Sysmon Event ID 1 on TARGET_WEBSERVER: Process Create where ParentImage is php-cgi.exe (or w3wp.exe for ASPX), Image is cmd.exe or whoami.exe, CommandLine contains 'whoami'. DeviceProcessEvents: InitiatingProcessFileName=php-cgi.exe spawning FileName=cmd.exe. IIS access log entry for GET /df00tech-test-shell.php with query string cmd=whoami, HTTP 200 response.
- Test 3Drop ASPX Webshell to IIS Webroot via Local File Copy
Expected signal: Sysmon Event ID 11: FileCreate for df00tech-test-shell.aspx in C:\inetpub\wwwroot\, InitiatingProcess=cmd.exe. DeviceFileEvents: FileCreated, FileName=df00tech-test-shell.aspx, FolderPath=C:\inetpub\wwwroot\, InitiatingProcessFileName=cmd.exe. Security Event ID 4663 if object-level SACL auditing is configured on the wwwroot directory.
- Test 4Enumerate Accessible Webroot Network Shares
Expected signal: Windows Security Event ID 5140 on TARGET_WEBSERVER: Network share \\TARGET_WEBSERVER\wwwroot accessed. Windows Security Event ID 5156: Windows Filtering Platform allowed inbound connection on port 445. Sysmon Event ID 3 on attacker host: outbound network connection to TARGET_WEBSERVER:445. Windows Security Event ID 4624: Type 3 (Network) logon to TARGET_WEBSERVER.
- Test 5PHP File Drop Simulating CMS Plugin Install Gone Wrong
Expected signal: Sysmon Event ID 11: FileCreate for df00tech-update.php in C:\inetpub\wwwroot\uploads\, InitiatingProcess=powershell.exe. DeviceFileEvents: FileCreated, FileName=df00tech-update.php, FolderPath=C:\inetpub\wwwroot\uploads\, InitiatingProcessFileName=powershell.exe. PowerShell ScriptBlock Log Event ID 4104 with Set-Content command writing PHP content.
References (10)
- https://attack.mitre.org/techniques/T1051/
- https://www.webroot.com/blog/2011/02/22/malicious-php-scripts-on-the-rise/
- http://httpd.apache.org/docs/2.4/getting-started.html#content
- https://capec.mitre.org/data/definitions/563.html
- https://learn.microsoft.com/en-us/iis/manage/configuring-security/application-pool-identities
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1505.003/T1505.003.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file
- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5140
- https://www.sans.org/reading-room/whitepapers/webserv/detecting-web-shells-33156
- https://www.cisa.gov/news-events/alerts/2021/02/10/cisa-er21-02-01-remediating-microsoft-exchange-vulnerabilities
Unlock Pro Content
Get the full detection package for T1051 including response playbook, investigation guide, and atomic red team tests.