Detect Server Software Component in Sumo Logic CSE

(_sourceCategory="windows/sysmon" OR _sourceCategory="sysmon" OR _sourceCategory="endpoint/sysmon")
| parse "<EventID>*</EventID>" as event_id nodrop
| parse "<Data Name='Image'>*</Data>" as image nodrop
| parse "<Data Name='ParentImage'>*</Data>" as parent_image nodrop
| parse "<Data Name='CommandLine'>*</Data>" as command_line nodrop
| parse "<Data Name='ParentCommandLine'>*</Data>" as parent_command_line nodrop
| parse "<Data Name='TargetFilename'>*</Data>" as target_filename nodrop
| parse "<Data Name='TargetObject'>*</Data>" as target_object nodrop
| parse "<Data Name='Details'>*</Data>" as registry_details nodrop
| parse "<Data Name='User'>*</Data>" as event_user nodrop
| parse "<Data Name='Computer'>*</Data>" as computer nodrop
| where event_id in ("1","11","13")
| where
  // Signal 1: Web server spawning suspicious child process
  (
    event_id = "1"
    and (
      parent_image matches "*w3wp.exe" or parent_image matches "*httpd.exe"
      or parent_image matches "*nginx.exe" or parent_image matches "*tomcat*"
      or parent_image matches "*java.exe" or parent_image matches "*php-cgi.exe"
      or parent_image matches "*perl.exe" or parent_image matches "*python.exe"
      or parent_image matches "*ruby.exe" or parent_image matches "*node.exe"
    )
    and (
      image matches "*cmd.exe" or image matches "*powershell.exe"
      or image matches "*pwsh.exe" or image matches "*wscript.exe"
      or image matches "*cscript.exe" or image matches "*mshta.exe"
      or image matches "*rundll32.exe" or image matches "*regsvr32.exe"
      or image matches "*certutil.exe" or image matches "*net.exe"
      or image matches "*net1.exe" or image matches "*whoami.exe"
      or image matches "*systeminfo.exe" or image matches "*nltest.exe"
      or image matches "*curl.exe" or image matches "*wget.exe"
      or image matches "*hostname.exe" or image matches "*ipconfig.exe"
    )
  )
  or
  // Signal 2: Suspicious web file written to web root directories
  (
    event_id = "11"
    and (
      target_filename matches "*\\inetpub\\*" or target_filename matches "*\\wwwroot\\*"
      or target_filename matches "*\\htdocs\\*" or target_filename matches "*\\webapps\\*"
      or target_filename matches "*\\public_html\\*" or target_filename matches "*/var/www/*"
      or target_filename matches "*/srv/www/*" or target_filename matches "*/usr/share/nginx/*"
    )
    and (
      target_filename matches "*.aspx" or target_filename matches "*.asp"
      or target_filename matches "*.php" or target_filename matches "*.jsp"
      or target_filename matches "*.jspx" or target_filename matches "*.cfm"
      or target_filename matches "*.ashx" or target_filename matches "*.asmx"
      or target_filename matches "*.phtml" or target_filename matches "*.shtml"
    )
    and not (
      image matches "*msiexec.exe" or image matches "*setup.exe"
      or image matches "*devenv.exe" or image matches "*code.exe"
      or image matches "*explorer.exe" or image matches "*robocopy.exe"
      or image matches "*xcopy.exe" or image matches "*w3wp.exe"
    )
  )
  or
  // Signal 3: IIS native module / ISAPI filter DLL registered via registry
  (
    event_id = "13"
    and (
      target_object matches "*\\CurrentControlSet\\Services\\W3SVC*"
      or target_object matches "*\\SOFTWARE\\Microsoft\\InetStp*"
      or target_object matches "*\\CurrentControlSet\\Services\\WAS*"
    )
    and registry_details matches "*.dll"
    and not (
      image matches "*msiexec.exe" or image matches "*TrustedInstaller.exe"
      or image matches "*wusa.exe"
    )
  )
| eval detection_type = if(event_id = "1", "WebShell_ChildProcess",
    if(event_id = "11", "SuspiciousWebFile_Written",
    if(event_id = "13", "IIS_Module_Registered", "Unknown")))
| eval severity_rating = if(
    event_id = "1" and (image matches "*cmd.exe" or image matches "*powershell.exe"
      or image matches "*pwsh.exe" or image matches "*wscript.exe"
      or image matches "*cscript.exe" or image matches "*mshta.exe"), "Critical",
    if(event_id in ("1","11","13"), "High", "Medium"))
| fields _messageTime, computer, event_user, image, command_line, parent_image, parent_command_line, target_filename, target_object, registry_details, detection_type, severity_rating
| sort by _messageTime desc