Detect Web Portal Capture in Elastic Security
Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. A compromised login page may log provided user credentials before logging the user in to the service. This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through External Remote Services and Valid Accounts, or as part of the initial compromise by exploitation of the externally facing web service. Notable examples include IceApple's OWA credential logger, WARPWIRE targeting Ivanti VPN portals, and Winter Vivern mimicking government email logon sites.
MITRE ATT&CK
- Tactic
- Collection Credential Access
- Technique
- T1056 Input Capture
- Sub-technique
- T1056.003 Web Portal Capture
- Canonical reference
- https://attack.mitre.org/techniques/T1056/003/
Elastic Detection Query
any where
(
event.category == "file" and
event.action in ("creation", "modification") and
process.name in~ ("w3wp.exe", "httpd", "nginx", "apache2", "iisexpress.exe", "tomcat", "java", "node", "python", "ruby", "php-cgi", "php") and
(
file.path like~ "*\\inetpub\\*" or file.path like~ "*\\wwwroot\\*" or
file.path like~ "*\\owa\\*" or file.path like~ "*\\ecp\\*" or
file.path like~ "*\\vpn\\*" or file.path like~ "*\\sslvpn\\*" or
file.path like~ "*\\exchange\\*" or file.path like~ "/var/www/*" or
file.path like~ "/opt/web/*" or file.path like~ "/usr/share/*"
) and
file.extension in ("php", "aspx", "asp", "jsp", "js", "html", "htm", "config")
)
or
(
event.category == "process" and
event.action == "start" and
process.parent.name in~ ("w3wp.exe", "httpd", "nginx", "apache2", "iisexpress.exe") and
process.name in~ ("cmd.exe", "powershell.exe", "sh", "bash", "python", "python3", "perl", "net.exe", "whoami.exe", "certutil.exe", "bitsadmin.exe")
)
or
(
event.category == "process" and
event.action == "start" and
process.name in~ ("w3wp.exe", "iisexpress.exe") and
(
process.command_line like~ "*password*" or process.command_line like~ "*credential*" or
process.command_line like~ "*username*" or process.command_line like~ "*passwd*" or
process.command_line like~ "*cookie*" or process.command_line like~ "*session*"
)
)Detects T1056.003 Web Portal Capture across three behavioral patterns using Elastic ECS fields: (1) web server processes (w3wp.exe, httpd, nginx, apache2) creating or modifying script files with web-executable extensions in known portal directories (inetpub, wwwroot, OWA, ECP, VPN paths, /var/www), (2) command interpreters or shells (cmd.exe, powershell.exe, bash, sh, python, perl) spawned as direct children of web server processes indicating web shell execution, and (3) IIS worker processes executing with credential-related keywords in their command lines. Covers both Windows IIS and Linux Apache/Nginx stacks. Use sequence queries with maxspan for correlated multi-event detection of the full kill chain.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate web application deployments via CI/CD pipelines (Azure DevOps, Jenkins, GitHub Actions) where the deployment agent runs in IIS app pool context and writes updated ASPX or PHP files to wwwroot during a scheduled release
- CMS platforms such as WordPress, Joomla, or Drupal performing plugin/theme auto-updates where the web server process writes new PHP files to web-accessible plugin directories under the httpd or nginx process context
- ASP.NET view precompilation and IIS application warmup procedures that cause w3wp.exe to spawn temporary compiler processes (csc.exe, vbc.exe) or write compiled view assemblies to temp paths under the web root
- Monitoring and APM agents (Dynatrace OneAgent, New Relic, AppDynamics) injected into IIS app pools that create instrumentation files or execute diagnostic subprocesses within the web server process context
- Let's Encrypt ACME challenge responders or load balancer health check scripts that create temporary verification files in webroot directories under the web server process
Other platforms for T1056.003
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Credential Capture File Creation in IIS Web Root
Expected signal: Sysmon Event ID 11 (FileCreate): TargetFilename=C:\inetpub\wwwroot\login_helper.php, Image=cmd.exe. DeviceFileEvents: ActionType=FileCreated, FolderPath contains \inetpub\wwwroot\, FileName=login_helper.php. Security Event 4663 if SACL auditing is enabled on the wwwroot directory.
- Test 2Web Server Process Spawning Command Shell (WebShell Simulation)
Expected signal: Sysmon Event ID 1 (Process Create): Image=cmd.exe, ParentImage=powershell.exe, CommandLine containing 'whoami'. Sysmon Event ID 11: TargetFilename=C:\Windows\Temp\webshell_test.txt. Security Event 4688 with NewProcessName=cmd.exe if process creation auditing is enabled.
- Test 3Inject Credential Capture Code into Existing ASPX Login Page
Expected signal: Sysmon Event ID 11 (FileCreate/Modify): TargetFilename=C:\inetpub\wwwroot\testportal\login.aspx, Image=powershell.exe. DeviceFileEvents: ActionType=FileModified, FileName=login.aspx, FolderPath contains \inetpub\wwwroot\. Security Event 4663 if SACL file auditing is configured on the web root.
- Test 4Simulate Credential Exfiltration via Web Server Outbound HTTP
Expected signal: Sysmon Event ID 3 (Network Connection): Image=powershell.exe, DestinationIp=127.0.0.1, DestinationPort=9001, Protocol=tcp. DeviceNetworkEvents: InitiatingProcessFileName=powershell.exe, RemotePort=9001. PowerShell ScriptBlock Log Event ID 4104 showing the HTTP POST with credential parameters.
References (8)
- https://attack.mitre.org/techniques/T1056/003/
- https://www.volexity.com/blog/2015/10/07/virtual-private-keylogging-cisco-web-vpns-leveraged-for-access-and-persistence/
- https://www.mandiant.com/resources/blog/cutting-edge-suspected-apt-targets-ivanti-connect-secure-vpn-in-new-zero-day-exploitation
- https://www.crowdstrike.com/blog/iceapple-a-novel-internet-information-services-post-exploitation-framework/
- https://www.sentinelone.com/labs/winter-vivern-all-summer-long-unattributed-threat-actor-from-russia-or-belarus/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1056.003/T1056.003.md
- https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-file-system
Unlock Pro Content
Get the full detection package for T1056.003 including response playbook, investigation guide, and atomic red team tests.