Exploit Public-Facing Application

let WebServerProcesses = dynamic(["w3wp.exe", "httpd.exe", "nginx.exe", "apache2.exe", "java.exe", "python.exe", "python3.exe", "php.exe", "php-cgi.exe", "node.exe", "ruby.exe", "perl.exe", "tomcat9.exe", "tomcat8.exe", "ews.exe", "umworkerprocess.exe", "msexchangeservicehost.exe"]);
let SuspiciousChildProcesses = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "curl.exe", "wget.exe", "nc.exe", "ncat.exe", "net.exe", "net1.exe", "whoami.exe", "ipconfig.exe", "systeminfo.exe", "nltest.exe", "ping.exe", "nslookup.exe", "tasklist.exe", "quser.exe", "schtasks.exe", "at.exe", "sc.exe", "reg.exe"]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ (WebServerProcesses)
| where FileName in~ (SuspiciousChildProcesses)
| extend ExploitEvidence = case(
    FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe"), "Shell Spawned",
    FileName in~ ("certutil.exe", "bitsadmin.exe", "curl.exe", "wget.exe", "nc.exe", "ncat.exe"), "Download/C2 Tool",
    FileName in~ ("whoami.exe", "ipconfig.exe", "systeminfo.exe", "nltest.exe", "net.exe", "net1.exe", "tasklist.exe", "quser.exe"), "Reconnaissance",
    FileName in~ ("schtasks.exe", "at.exe", "sc.exe", "reg.exe"), "Persistence Attempt",
    "Suspicious Child"
)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName,
         ExploitEvidence, SHA256
| sort by Timestamp desc

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval ParentImageLower=lower(ParentImage)
| eval ChildImageLower=lower(Image)
| where match(ParentImageLower, "(w3wp\.exe|httpd\.exe|nginx\.exe|apache2\.exe|java\.exe|python\.exe|python3\.exe|php\.exe|php-cgi\.exe|node\.exe|ruby\.exe|perl\.exe|tomcat[0-9]*\.exe|ews\.exe|umworkerprocess\.exe|msexchangeservicehost\.exe)")
| where match(ChildImageLower, "(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|certutil\.exe|bitsadmin\.exe|curl\.exe|wget\.exe|nc\.exe|ncat\.exe|net\.exe|net1\.exe|whoami\.exe|ipconfig\.exe|systeminfo\.exe|nltest\.exe|ping\.exe|nslookup\.exe|tasklist\.exe|schtasks\.exe|at\.exe|sc\.exe|reg\.exe)")
| eval ExploitEvidence=case(
    match(ChildImageLower, "(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe)"), "Shell Spawned",
    match(ChildImageLower, "(certutil\.exe|bitsadmin\.exe|curl\.exe|wget\.exe|nc\.exe|ncat\.exe)"), "Download/C2 Tool",
    match(ChildImageLower, "(whoami\.exe|ipconfig\.exe|systeminfo\.exe|nltest\.exe|net\.exe|net1\.exe|tasklist\.exe)"), "Reconnaissance",
    match(ChildImageLower, "(schtasks\.exe|at\.exe|sc\.exe|reg\.exe)"), "Persistence Attempt",
    true(), "Suspicious Child"
)
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine, ExploitEvidence
| sort - _time

process where event.type == "start" and
  process.parent.name : ("w3wp.exe", "httpd.exe", "nginx.exe", "apache2.exe", "java.exe", "python.exe", "python3.exe", "php.exe", "php-cgi.exe", "node.exe", "ruby.exe", "perl.exe", "tomcat9.exe", "tomcat8.exe", "ews.exe", "umworkerprocess.exe", "msexchangeservicehost.exe") and
  process.name : ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "curl.exe", "wget.exe", "nc.exe", "ncat.exe", "net.exe", "net1.exe", "whoami.exe", "ipconfig.exe", "systeminfo.exe", "nltest.exe", "ping.exe", "nslookup.exe", "tasklist.exe", "quser.exe", "schtasks.exe", "at.exe", "sc.exe", "reg.exe")

SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
  LOGSOURCENAME(logsourceid) AS LogSource,
  LOGSOURCETYPENAME(logsourceid) AS LogSourceType,
  sourceip,
  username,
  "ParentProcessName",
  "ProcessName",
  "CommandLine",
  "ParentCommandLine",
  CATEGORYNAME(category) AS Category,
  CASE
    WHEN LOWER("ProcessName") SIMILAR TO '%(cmd.exe|powershell.exe|pwsh.exe|wscript.exe|cscript.exe|mshta.exe)%' THEN 'Shell Spawned'
    WHEN LOWER("ProcessName") SIMILAR TO '%(certutil.exe|bitsadmin.exe|curl.exe|wget.exe|nc.exe|ncat.exe)%' THEN 'Download/C2 Tool'
    WHEN LOWER("ProcessName") SIMILAR TO '%(whoami.exe|ipconfig.exe|systeminfo.exe|nltest.exe|net.exe|net1.exe|tasklist.exe|quser.exe)%' THEN 'Reconnaissance'
    WHEN LOWER("ProcessName") SIMILAR TO '%(schtasks.exe|at.exe|sc.exe|reg.exe)%' THEN 'Persistence Attempt'
    ELSE 'Suspicious Child'
  END AS ExploitEvidence
FROM events
WHERE
  LOGSOURCETYPENAME(logsourceid) IN ('Microsoft Windows Security Event Log', 'Snare for Windows')
  AND (
    LOWER("ParentProcessName") SIMILAR TO '%(w3wp.exe|httpd.exe|nginx.exe|apache2.exe|java.exe|python.exe|python3.exe|php.exe|php-cgi.exe|node.exe|ruby.exe|perl.exe|tomcat%.exe|ews.exe|umworkerprocess.exe|msexchangeservicehost.exe)%'
  )
  AND (
    LOWER("ProcessName") SIMILAR TO '%(cmd.exe|powershell.exe|pwsh.exe|wscript.exe|cscript.exe|mshta.exe|rundll32.exe|regsvr32.exe|certutil.exe|bitsadmin.exe|curl.exe|wget.exe|nc.exe|ncat.exe|net.exe|net1.exe|whoami.exe|ipconfig.exe|systeminfo.exe|nltest.exe|ping.exe|nslookup.exe|tasklist.exe|quser.exe|schtasks.exe|at.exe|sc.exe|reg.exe)%'
  )
ORDER BY devicetime DESC
LAST 24 HOURS

(_sourceCategory=*windows* OR _sourceCategory=*sysmon* OR _sourceCategory=*winlogbeat*)
| where EventID = "1" or EventCode = "1"
| parse field=ParentImage "*\\*" as _throwaway, ParentProcessName nocase
| parse field=Image "*\\*" as _throwaway2, ChildProcessName nocase
| where ParentProcessName matches /(?i)^(w3wp\.exe|httpd\.exe|nginx\.exe|apache2\.exe|java\.exe|python\.exe|python3\.exe|php\.exe|php-cgi\.exe|node\.exe|ruby\.exe|perl\.exe|tomcat[0-9]*\.exe|ews\.exe|umworkerprocess\.exe|msexchangeservicehost\.exe)$/
| where ChildProcessName matches /(?i)^(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|certutil\.exe|bitsadmin\.exe|curl\.exe|wget\.exe|nc\.exe|ncat\.exe|net\.exe|net1\.exe|whoami\.exe|ipconfig\.exe|systeminfo\.exe|nltest\.exe|ping\.exe|nslookup\.exe|tasklist\.exe|quser\.exe|schtasks\.exe|at\.exe|sc\.exe|reg\.exe)$/
| if (ChildProcessName matches /(?i)^(cmd|powershell|pwsh|wscript|cscript|mshta)\.exe$/, "Shell Spawned",
    if (ChildProcessName matches /(?i)^(certutil|bitsadmin|curl|wget|nc|ncat)\.exe$/, "Download/C2 Tool",
    if (ChildProcessName matches /(?i)^(whoami|ipconfig|systeminfo|nltest|net|net1|tasklist|quser)\.exe$/, "Reconnaissance",
    if (ChildProcessName matches /(?i)^(schtasks|at|sc|reg)\.exe$/, "Persistence Attempt", "Suspicious Child")))) as ExploitEvidence
| fields _messageTime, Computer, User, Image, CommandLine, ParentImage, ParentCommandLine, ExploitEvidence
| sort by _messageTime desc

rule t1190_exploit_public_facing_application {
  meta:
    author = "Detection Engineering"
    description = "Detects web server and application runtime processes spawning suspicious child processes indicative of public-facing application exploitation (T1190)"
    mitre_attack_tactic = "Initial Access"
    mitre_attack_technique = "T1190"
    mitre_attack_technique_id = "T1190"
    severity = "HIGH"
    confidence = "HIGH"
    platform = "Windows"
    reference = "https://attack.mitre.org/techniques/T1190/"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.process.file.full_path = /(?i)(w3wp\.exe|httpd\.exe|nginx\.exe|apache2\.exe|java\.exe|python\.exe|python3\.exe|php\.exe|php-cgi\.exe|node\.exe|ruby\.exe|perl\.exe|tomcat[0-9]*\.exe|ews\.exe|umworkerprocess\.exe|msexchangeservicehost\.exe)$/
    $e.target.process.file.full_path = /(?i)(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|certutil\.exe|bitsadmin\.exe|curl\.exe|wget\.exe|nc\.exe|ncat\.exe|net\.exe|net1\.exe|whoami\.exe|ipconfig\.exe|systeminfo\.exe|nltest\.exe|ping\.exe|nslookup\.exe|tasklist\.exe|quser\.exe|schtasks\.exe|at\.exe|sc\.exe|reg\.exe)$/
    $e.principal.hostname = $hostname
    $e.principal.user.userid = $user

  condition:
    $e
}

#event_simpleName=ProcessRollup2
| ParentBaseFileName = /(?i)^(w3wp|httpd|nginx|apache2|java|python|python3|php|php-cgi|node|ruby|perl|tomcat[0-9]*|ews|umworkerprocess|msexchangeservicehost)\.exe$/
| FileName = /(?i)^(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin|curl|wget|nc|ncat|net|net1|whoami|ipconfig|systeminfo|nltest|ping|nslookup|tasklist|quser|schtasks|at|sc|reg)\.exe$/
| ExploitEvidence := case {
    FileName = /(?i)^(cmd|powershell|pwsh|wscript|cscript|mshta)\.exe$/ => "Shell Spawned";
    FileName = /(?i)^(certutil|bitsadmin|curl|wget|nc|ncat)\.exe$/ => "Download/C2 Tool";
    FileName = /(?i)^(whoami|ipconfig|systeminfo|nltest|net|net1|tasklist|quser)\.exe$/ => "Reconnaissance";
    FileName = /(?i)^(schtasks|at|sc|reg)\.exe$/ => "Persistence Attempt";
    * => "Suspicious Child"
  }
| table([timestamp, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, ParentCommandLine, ExploitEvidence, SHA256HashData, TargetProcessId, ContextProcessId])
| sort(timestamp, order=desc)