Detect Web Portal Capture in IBM QRadar
Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. A compromised login page may log provided user credentials before logging the user in to the service. This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through External Remote Services and Valid Accounts, or as part of the initial compromise by exploitation of the externally facing web service. Notable examples include IceApple's OWA credential logger, WARPWIRE targeting Ivanti VPN portals, and Winter Vivern mimicking government email logon sites.
MITRE ATT&CK
- Tactic
- Collection Credential Access
- Technique
- T1056 Input Capture
- Sub-technique
- T1056.003 Web Portal Capture
- Canonical reference
- https://attack.mitre.org/techniques/T1056/003/
QRadar Detection Query
SELECT
DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
LOGSOURCENAME(logsourceid) AS LogSourceName,
sourceip AS SourceIP,
username AS UserName,
QIDNAME(qid) AS EventName,
"Image" AS ProcessImage,
"CommandLine" AS CommandLine,
"ParentImage" AS ParentImage,
"TargetFilename" AS TargetFilename,
CATEGORYNAME(category) AS Category,
CASE
WHEN QIDNAME(qid) LIKE '%File Create%' THEN 'WebFileCreation'
WHEN ("Image" LIKE '%cmd.exe' OR "Image" LIKE '%powershell.exe' OR "Image" LIKE '%bash.exe' OR "Image" LIKE '%sh.exe')
AND ("ParentImage" LIKE '%w3wp.exe' OR "ParentImage" LIKE '%iisexpress.exe' OR "ParentImage" LIKE '%httpd%' OR "ParentImage" LIKE '%nginx%')
THEN 'WebShellSpawn'
WHEN "Image" LIKE '%w3wp.exe' OR "Image" LIKE '%iisexpress.exe' THEN 'WebProcessCredentialExec'
ELSE 'Unknown'
END AS EventType,
(CASE WHEN "TargetFilename" LIKE '%inetpub%' OR "TargetFilename" LIKE '%wwwroot%'
OR "TargetFilename" LIKE '%\owa\%' OR "TargetFilename" LIKE '%\ecp\%'
OR "TargetFilename" LIKE '%\vpn\%' OR "TargetFilename" LIKE '%/var/www/%'
THEN 1 ELSE 0 END
+ CASE WHEN LOWER("CommandLine") LIKE '%password%' OR LOWER("CommandLine") LIKE '%credential%'
OR LOWER("CommandLine") LIKE '%passwd%' OR LOWER("CommandLine") LIKE '%username%'
OR LOWER("CommandLine") LIKE '%token%' OR LOWER("CommandLine") LIKE '%cookie%'
THEN 1 ELSE 0 END
+ CASE WHEN ("Image" LIKE '%cmd.exe' OR "Image" LIKE '%powershell.exe' OR "Image" LIKE '%bash.exe' OR "Image" LIKE '%sh.exe')
AND ("ParentImage" LIKE '%w3wp.exe' OR "ParentImage" LIKE '%iisexpress.exe'
OR "ParentImage" LIKE '%httpd%' OR "ParentImage" LIKE '%nginx%')
THEN 1 ELSE 0 END) AS SuspicionScore
FROM events
WHERE
devicetime > (CURRENT_TIMESTAMP - 86400000)
AND (
(
("TargetFilename" LIKE '%\inetpub\%' OR "TargetFilename" LIKE '%\wwwroot\%'
OR "TargetFilename" LIKE '%\owa\%' OR "TargetFilename" LIKE '%\ecp\%'
OR "TargetFilename" LIKE '%\vpn\%' OR "TargetFilename" LIKE '%\sslvpn\%'
OR "TargetFilename" LIKE '%/var/www/%' OR "TargetFilename" LIKE '%/opt/web/%')
AND ("TargetFilename" LIKE '%.aspx' OR "TargetFilename" LIKE '%.asp'
OR "TargetFilename" LIKE '%.php' OR "TargetFilename" LIKE '%.jsp'
OR "TargetFilename" LIKE '%.js' OR "TargetFilename" LIKE '%.config')
AND ("Image" LIKE '%\w3wp.exe' OR "Image" LIKE '%\iisexpress.exe'
OR "Image" LIKE '%\httpd.exe' OR "Image" LIKE '%\nginx.exe'
OR "Image" LIKE '%/httpd' OR "Image" LIKE '%/nginx' OR "Image" LIKE '%/apache2')
)
OR (
("ParentImage" LIKE '%\w3wp.exe' OR "ParentImage" LIKE '%\iisexpress.exe'
OR "ParentImage" LIKE '%\httpd.exe' OR "ParentImage" LIKE '%/httpd'
OR "ParentImage" LIKE '%/nginx' OR "ParentImage" LIKE '%/apache2')
AND ("Image" LIKE '%\cmd.exe' OR "Image" LIKE '%\powershell.exe'
OR "Image" LIKE '%\bash.exe' OR "Image" LIKE '%\sh.exe'
OR "Image" LIKE '%\net.exe' OR "Image" LIKE '%\whoami.exe'
OR "Image" LIKE '%/bash' OR "Image" LIKE '%/sh' OR "Image" LIKE '%/python%')
)
OR (
("Image" LIKE '%\w3wp.exe' OR "Image" LIKE '%\iisexpress.exe')
AND (
LOWER("CommandLine") LIKE '%password%' OR LOWER("CommandLine") LIKE '%credential%'
OR LOWER("CommandLine") LIKE '%username%' OR LOWER("CommandLine") LIKE '%passwd%'
OR LOWER("CommandLine") LIKE '%token%' OR LOWER("CommandLine") LIKE '%cookie%'
OR LOWER("CommandLine") LIKE '%session%'
)
)
)
ORDER BY EventTime DESC, SuspicionScore DESCIBM QRadar AQL query detecting T1056.003 Web Portal Capture using Sysmon and Windows Security event log data ingested via QRadar DSMs. Identifies three behavior clusters: script-file creation in web portal directories (inetpub, wwwroot, OWA, ECP, VPN, /var/www) by recognized web server processes; shells or interpreters spawned directly from IIS/Apache/Nginx parent processes; and IIS worker processes executing with credential-related keywords in their command line arguments. A computed SuspicionScore (0-3) combines all three indicators for analyst triage prioritization. Requires Sysmon log source mapped in QRadar with Event ID 1 (Process Create) and Event ID 11 (File Create) normalized fields Image, ParentImage, CommandLine, and TargetFilename available as custom event properties.
Data Sources
Required Tables
False Positives & Tuning
- Automated application deployment tools (Octopus Deploy, Azure Pipelines release agents) that run under IIS application pool identity and write updated ASPX files directly to the wwwroot during a production deployment window
- Web application frameworks performing dynamic compilation or template rendering (ASP.NET Razor view compilation, JSP precompilation by Tomcat) that cause the web server process to write compiled artifacts to temporary directories under the web root
- Third-party web application monitoring agents (Dynatrace, AppDynamics, New Relic) that inject into the IIS worker process and create temporary instrumentation files or spawn short-lived diagnostic child processes with credential-adjacent field names in their arguments
Other platforms for T1056.003
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Credential Capture File Creation in IIS Web Root
Expected signal: Sysmon Event ID 11 (FileCreate): TargetFilename=C:\inetpub\wwwroot\login_helper.php, Image=cmd.exe. DeviceFileEvents: ActionType=FileCreated, FolderPath contains \inetpub\wwwroot\, FileName=login_helper.php. Security Event 4663 if SACL auditing is enabled on the wwwroot directory.
- Test 2Web Server Process Spawning Command Shell (WebShell Simulation)
Expected signal: Sysmon Event ID 1 (Process Create): Image=cmd.exe, ParentImage=powershell.exe, CommandLine containing 'whoami'. Sysmon Event ID 11: TargetFilename=C:\Windows\Temp\webshell_test.txt. Security Event 4688 with NewProcessName=cmd.exe if process creation auditing is enabled.
- Test 3Inject Credential Capture Code into Existing ASPX Login Page
Expected signal: Sysmon Event ID 11 (FileCreate/Modify): TargetFilename=C:\inetpub\wwwroot\testportal\login.aspx, Image=powershell.exe. DeviceFileEvents: ActionType=FileModified, FileName=login.aspx, FolderPath contains \inetpub\wwwroot\. Security Event 4663 if SACL file auditing is configured on the web root.
- Test 4Simulate Credential Exfiltration via Web Server Outbound HTTP
Expected signal: Sysmon Event ID 3 (Network Connection): Image=powershell.exe, DestinationIp=127.0.0.1, DestinationPort=9001, Protocol=tcp. DeviceNetworkEvents: InitiatingProcessFileName=powershell.exe, RemotePort=9001. PowerShell ScriptBlock Log Event ID 4104 showing the HTTP POST with credential parameters.
References (8)
- https://attack.mitre.org/techniques/T1056/003/
- https://www.volexity.com/blog/2015/10/07/virtual-private-keylogging-cisco-web-vpns-leveraged-for-access-and-persistence/
- https://www.mandiant.com/resources/blog/cutting-edge-suspected-apt-targets-ivanti-connect-secure-vpn-in-new-zero-day-exploitation
- https://www.crowdstrike.com/blog/iceapple-a-novel-internet-information-services-post-exploitation-framework/
- https://www.sentinelone.com/labs/winter-vivern-all-summer-long-unattributed-threat-actor-from-russia-or-belarus/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1056.003/T1056.003.md
- https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-file-system
Unlock Pro Content
Get the full detection package for T1056.003 including response playbook, investigation guide, and atomic red team tests.