Detect Web Portal Capture in Microsoft Sentinel
Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. A compromised login page may log provided user credentials before logging the user in to the service. This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through External Remote Services and Valid Accounts, or as part of the initial compromise by exploitation of the externally facing web service. Notable examples include IceApple's OWA credential logger, WARPWIRE targeting Ivanti VPN portals, and Winter Vivern mimicking government email logon sites.
MITRE ATT&CK
- Tactic
- Collection Credential Access
- Technique
- T1056 Input Capture
- Sub-technique
- T1056.003 Web Portal Capture
- Canonical reference
- https://attack.mitre.org/techniques/T1056/003/
KQL Detection Query
let WebPortalPaths = dynamic([
"\\inetpub\\", "\\wwwroot\\", "\\webroot\\",
"\\pulse\\", "\\juniper\\", "\\vpn\\",
"\\owa\\", "\\ecp\\", "\\exchange\\",
"\\fortiweb\\", "\\sslvpn\\", "\\remote\\",
"/var/www/", "/opt/web/", "/usr/share/"
]);
let SuspiciousWebFileExtensions = dynamic([".php", ".aspx", ".asp", ".jsp", ".js", ".html", ".htm", ".config"]);
let CredentialKeywords = dynamic(["password", "passwd", "credential", "username", "login", "auth", "token", "session", "cookie"]);
// Detection 1: File modification in web portal directories by web server processes
let WebFileModifications = DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated", "FileModified")
| where InitiatingProcessFileName in~ ("w3wp.exe", "httpd", "nginx", "apache2", "tomcat", "java", "node", "python", "ruby", "php-cgi", "php")
or FolderPath has_any (WebPortalPaths)
| where FileName has_any (SuspiciousWebFileExtensions)
| extend IsWebServerProcess = InitiatingProcessFileName in~ ("w3wp.exe", "httpd", "nginx", "apache2")
| extend IsWebPath = FolderPath has_any (WebPortalPaths)
| project Timestamp, DeviceName, ActionType, FolderPath, FileName,
InitiatingProcessFileName, InitiatingProcessCommandLine,
InitiatingProcessAccountName, IsWebServerProcess, IsWebPath;
// Detection 2: Suspicious script execution by web server processes with credential-related content
let WebProcessExecution = DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("w3wp.exe", "httpd", "nginx", "apache2", "iisexpress.exe")
or (FileName in~ ("cmd.exe", "powershell.exe", "sh", "bash", "python", "python3", "perl")
and InitiatingProcessFileName in~ ("w3wp.exe", "httpd", "nginx", "apache2"))
| extend IsChildShell = FileName in~ ("cmd.exe", "powershell.exe", "sh", "bash")
| project Timestamp, DeviceName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine,
AccountName, IsChildShell;
// Detection 3: Registry modifications by web processes (persistence of credential capture code)
let WebRegistryChanges = DeviceRegistryEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("w3wp.exe", "httpd", "nginx", "apache2", "iisexpress.exe")
| where ActionType in ("RegistryValueSet", "RegistryKeyCreated")
| project Timestamp, DeviceName, ActionType, RegistryKey, RegistryValueName, RegistryValueData,
InitiatingProcessFileName, InitiatingProcessAccountName;
WebFileModifications
| union WebProcessExecution
| union WebRegistryChanges
| extend DetectionSource = case(
isnotempty(ActionType) and ActionType in ("FileCreated", "FileModified"), "WebFileModification",
isnotempty(FileName) and FileName in~ ("cmd.exe", "powershell.exe", "sh", "bash"), "WebShellExecution",
isnotempty(RegistryKey), "WebRegistryChange",
"Unknown")
| sort by Timestamp descDetects web portal credential capture activity using Microsoft Defender for Endpoint tables. Monitors for suspicious file creation/modification in web portal directories by web server processes (IIS w3wp.exe, Apache httpd, nginx), web server processes spawning command shells, and registry modifications by web server processes. Covers IIS-hosted portals (OWA, Exchange), VPN portals, and Linux-based web servers. Correlates file events, process events, and registry events across the web server context.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate web application deployments or updates that modify web portal files via w3wp.exe or deployment scripts
- Web application frameworks (ASP.NET, PHP) dynamically generating or caching compiled files in wwwroot directories
- Security scanning tools or web application firewalls writing log or config files to web directories
- IIS application pool recycles or maintenance scripts spawning cmd.exe or powershell.exe for configuration tasks
Other platforms for T1056.003
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Credential Capture File Creation in IIS Web Root
Expected signal: Sysmon Event ID 11 (FileCreate): TargetFilename=C:\inetpub\wwwroot\login_helper.php, Image=cmd.exe. DeviceFileEvents: ActionType=FileCreated, FolderPath contains \inetpub\wwwroot\, FileName=login_helper.php. Security Event 4663 if SACL auditing is enabled on the wwwroot directory.
- Test 2Web Server Process Spawning Command Shell (WebShell Simulation)
Expected signal: Sysmon Event ID 1 (Process Create): Image=cmd.exe, ParentImage=powershell.exe, CommandLine containing 'whoami'. Sysmon Event ID 11: TargetFilename=C:\Windows\Temp\webshell_test.txt. Security Event 4688 with NewProcessName=cmd.exe if process creation auditing is enabled.
- Test 3Inject Credential Capture Code into Existing ASPX Login Page
Expected signal: Sysmon Event ID 11 (FileCreate/Modify): TargetFilename=C:\inetpub\wwwroot\testportal\login.aspx, Image=powershell.exe. DeviceFileEvents: ActionType=FileModified, FileName=login.aspx, FolderPath contains \inetpub\wwwroot\. Security Event 4663 if SACL file auditing is configured on the web root.
- Test 4Simulate Credential Exfiltration via Web Server Outbound HTTP
Expected signal: Sysmon Event ID 3 (Network Connection): Image=powershell.exe, DestinationIp=127.0.0.1, DestinationPort=9001, Protocol=tcp. DeviceNetworkEvents: InitiatingProcessFileName=powershell.exe, RemotePort=9001. PowerShell ScriptBlock Log Event ID 4104 showing the HTTP POST with credential parameters.
References (8)
- https://attack.mitre.org/techniques/T1056/003/
- https://www.volexity.com/blog/2015/10/07/virtual-private-keylogging-cisco-web-vpns-leveraged-for-access-and-persistence/
- https://www.mandiant.com/resources/blog/cutting-edge-suspected-apt-targets-ivanti-connect-secure-vpn-in-new-zero-day-exploitation
- https://www.crowdstrike.com/blog/iceapple-a-novel-internet-information-services-post-exploitation-framework/
- https://www.sentinelone.com/labs/winter-vivern-all-summer-long-unattributed-threat-actor-from-russia-or-belarus/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1056.003/T1056.003.md
- https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-file-system
Unlock Pro Content
Get the full detection package for T1056.003 including response playbook, investigation guide, and atomic red team tests.