Detect Web Portal Capture in CrowdStrike LogScale
Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. A compromised login page may log provided user credentials before logging the user in to the service. This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through External Remote Services and Valid Accounts, or as part of the initial compromise by exploitation of the externally facing web service. Notable examples include IceApple's OWA credential logger, WARPWIRE targeting Ivanti VPN portals, and Winter Vivern mimicking government email logon sites.
MITRE ATT&CK
- Tactic
- Collection Credential Access
- Technique
- T1056 Input Capture
- Sub-technique
- T1056.003 Web Portal Capture
- Canonical reference
- https://attack.mitre.org/techniques/T1056/003/
LogScale Detection Query
#event_simpleName = /^(FileCreate|ProcessRollup2)$/
| case {
#event_simpleName = "FileCreate"
| test(TargetFileName = /\\inetpub\\|\\wwwroot\\|\\webroot\\|\\owa\\|\\ecp\\|\\vpn\\|\\sslvpn\\|\\exchange\\|\/var\/www\/|\/opt\/web\//i)
| test(TargetFileName = /\.(aspx|asp|php|jsp|js|html|htm|config)$/i)
| test(ImageFileName = /w3wp\.exe|iisexpress\.exe|httpd\.exe|nginx\.exe|apache2|php-cgi\.exe|tomcat/i)
| DetectionType := "WebFileCreation";
#event_simpleName = "ProcessRollup2"
| test(ParentBaseFileName = /w3wp\.exe|iisexpress\.exe|httpd\.exe|nginx\.exe|apache2/i)
| test(FileName = /cmd\.exe|powershell\.exe|bash|sh\.exe|python\.exe|python3|perl\.exe|whoami\.exe|net\.exe|certutil\.exe|bitsadmin\.exe|wscript\.exe|cscript\.exe/i)
| DetectionType := "WebShellSpawn";
#event_simpleName = "ProcessRollup2"
| test(FileName = /w3wp\.exe|iisexpress\.exe/i)
| test(CommandLine = /password|passwd|credential|username|login|auth|token|cookie|session/i)
| DetectionType := "CredentialKeywordInWebProcess";
* | drop()
}
| groupBy(
[ComputerName, DetectionType, FileName, ParentBaseFileName, TargetFileName, CommandLine, UserName],
function=[
count(as=EventCount),
min(_time, as=FirstSeen),
max(_time, as=LastSeen)
]
)
| eval DurationMinutes = (LastSeen - FirstSeen) / 60000
| sort(EventCount, order=desc)CrowdStrike LogScale (Falcon) query detecting T1056.003 Web Portal Capture using Falcon sensor telemetry across three detection branches via a case expression: (1) FileCreate events where ImageFileName matches a web server process and TargetFileName is a web-executable script extension in a recognized web portal directory path — catches credential capture implant drops; (2) ProcessRollup2 events where ParentBaseFileName is a web server and FileName is a command interpreter or shell — catches active web shell execution; (3) ProcessRollup2 events where the IIS worker process itself executes with credential-related keywords in its CommandLine — catches direct credential capture invocations. Results are grouped by host, detection type, and process context with event counts and first/last seen timestamps for prioritized analyst review. Adjust regex patterns to match custom web application directory structures in your environment.
Data Sources
Required Tables
False Positives & Tuning
- Application deployment pipelines running under the IIS application pool identity (APPPOOL\AppName) that push updated ASPX or web.config files to the production wwwroot during a blue-green deployment or automated release, triggering FileCreate events from w3wp.exe with portal directory paths
- ASP.NET dynamic view compilation where IIS worker processes write pre-compiled Razor view assemblies or temporary ASPX compilation artifacts to directories under the web root, and may spawn csc.exe (C# compiler) which could overlap with interpreter patterns in the WebShellSpawn branch if not excluded by path
- Web server management control planes (Plesk, cPanel, DirectAdmin) that operate in the web server process context and legitimately create, modify, or execute scripts in managed web application directories as part of customer-facing hosting operations
Other platforms for T1056.003
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Credential Capture File Creation in IIS Web Root
Expected signal: Sysmon Event ID 11 (FileCreate): TargetFilename=C:\inetpub\wwwroot\login_helper.php, Image=cmd.exe. DeviceFileEvents: ActionType=FileCreated, FolderPath contains \inetpub\wwwroot\, FileName=login_helper.php. Security Event 4663 if SACL auditing is enabled on the wwwroot directory.
- Test 2Web Server Process Spawning Command Shell (WebShell Simulation)
Expected signal: Sysmon Event ID 1 (Process Create): Image=cmd.exe, ParentImage=powershell.exe, CommandLine containing 'whoami'. Sysmon Event ID 11: TargetFilename=C:\Windows\Temp\webshell_test.txt. Security Event 4688 with NewProcessName=cmd.exe if process creation auditing is enabled.
- Test 3Inject Credential Capture Code into Existing ASPX Login Page
Expected signal: Sysmon Event ID 11 (FileCreate/Modify): TargetFilename=C:\inetpub\wwwroot\testportal\login.aspx, Image=powershell.exe. DeviceFileEvents: ActionType=FileModified, FileName=login.aspx, FolderPath contains \inetpub\wwwroot\. Security Event 4663 if SACL file auditing is configured on the web root.
- Test 4Simulate Credential Exfiltration via Web Server Outbound HTTP
Expected signal: Sysmon Event ID 3 (Network Connection): Image=powershell.exe, DestinationIp=127.0.0.1, DestinationPort=9001, Protocol=tcp. DeviceNetworkEvents: InitiatingProcessFileName=powershell.exe, RemotePort=9001. PowerShell ScriptBlock Log Event ID 4104 showing the HTTP POST with credential parameters.
References (8)
- https://attack.mitre.org/techniques/T1056/003/
- https://www.volexity.com/blog/2015/10/07/virtual-private-keylogging-cisco-web-vpns-leveraged-for-access-and-persistence/
- https://www.mandiant.com/resources/blog/cutting-edge-suspected-apt-targets-ivanti-connect-secure-vpn-in-new-zero-day-exploitation
- https://www.crowdstrike.com/blog/iceapple-a-novel-internet-information-services-post-exploitation-framework/
- https://www.sentinelone.com/labs/winter-vivern-all-summer-long-unattributed-threat-actor-from-russia-or-belarus/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1056.003/T1056.003.md
- https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-file-system
Unlock Pro Content
Get the full detection package for T1056.003 including response playbook, investigation guide, and atomic red team tests.