Detection: Windows Suspicious Child Process Spawned From WebServer

  1
  2| tstats `security_content_summariesonly`
  3  count max(_time) as lastTime
  4        min(_time) as firstTime
  5
  6FROM datamodel=Endpoint.Processes WHERE
  7
  8Processes.parent_process_name IN (
  9    "apache*.exe",
 10    "beasvc.exe",
 11    "caddy.exe",
 12    "coldfusion.exe",
 13    "frankenphp.exe",
 14    "http*.exe",
 15    "iisexpress.exe",
 16    "java.exe",
 17    "javaw.exe",
 18    "jbosssvc.exe",
 19    "jrun.exe",
 20    "lighttpd.exe",
 21    "lsphp*.exe",
 22    "nginx*.exe",
 23    "openresty.exe",
 24    "php*.exe",
 25    "roadrunner.exe",
 26    "tomcat*.exe",
 27    "traefik.exe",
 28    "UMWorkerProcess.exe",
 29    "w3wp.exe",
 30    "wildfly-service.exe",
 31    "ws_TomcatService.exe"
 32)
 33NOT Processes.parent_process_name IN ("phpstorm*")
 34
 35Processes.process_name IN (
 36    "adfind.exe", "arp.exe", "at.exe", "bitsadmin.exe", "certreq.exe", "certutil.exe", "cmdkey.exe",
 37    "cscript.exe", "curl.exe", "dnscmd.exe", "dsget.exe", "dsquery.exe", "find.exe", "findstr.exe",
 38    "fsutil.exe", "getmac.exe", "hostname.exe", "ipconfig.exe", "klist.exe", "mshta.exe",
 39    "nbtstat.exe", "net.exe", "net1.exe", "netdom.exe", "netsh.exe", "netstat.exe", "nltest.exe",
 40    "nslookup.exe", "ntdsutil.exe", "pathping.exe", "perl.exe", "ping.exe", "python.exe",
 41    "qprocess.exe", "query.exe", "quser.exe", "qwinsta.exe", "reg.exe", "regsvr32.exe", "route.exe",
 42    "rundll32.exe", "sc.exe", "schtasks.exe", "scrcons.exe", "setspn.exe", "systeminfo.exe",
 43    "tasklist.exe", "tracert.exe", "vssadmin.exe", "wevtutil.exe", "wget.exe", "whoami.exe",
 44    "wmic.exe", "wscript.exe", "wusa.exe"
 45)
 46
 47BY Processes.action Processes.dest Processes.original_file_name
 48   Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
 49   Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
 50   Processes.process Processes.process_exec Processes.process_guid
 51   Processes.process_hash Processes.process_id Processes.process_integrity_level
 52   Processes.process_name Processes.process_path Processes.user
 53   Processes.user_id Processes.vendor_product
 54
 55
 56| `drop_dm_object_name("Processes")`
 57
 58```Keep Java and JavaW parents only when their command line identifies a known web or application server.```
 59
 60
 61| where (
 62    NOT match(parent_process_name, "(?i)^javaw?(\.exe)?$")
 63    OR match(parent_process, "(?i)(org\.apache\.catalina\.startup\.Bootstrap
 64|-Dcatalina\.base=
 65|org\.eclipse\.jetty\.start\.Main
 66|-Djetty\.home=
 67|org\.jboss\.modules\.Main
 68|-Djboss\.home\.dir=
 69|weblogic\.Server
 70|-Dweblogic\.Name=
 71|weblogic-launcher\.jar
 72|com\.ibm\.ws\.runtime\.WsServer
 73|com\.ibm\.ws\.kernel\.boot\.cmdline\.Bootstrap
 74|com\.sun\.enterprise\.glassfish\.bootstrap\.ASMain
 75|com\.caucho\.server\.resin\.Resin)")
 76    OR match(parent_process, "(?i)(org\.springframework\.boot\.loader\.
 77|quarkus-run\.jar
 78|io\.quarkus\.runner\.GeneratedMain
 79|io\.micronaut\.runtime\.Micronaut
 80|io\.dropwizard\.cli\.ServerCommand
 81|play\.core\.server\.ProdServerStart
 82|io\.helidon\.microprofile\.server\.Main
 83|io\.helidon\.webserver
 84|io\.vertx\.core\.Launcher)")
 85    OR match(parent_process, "(?i)(org\.keycloak
 86|org\.apereo\.cas
 87|org\.elasticsearch\.bootstrap\.Elasticsearch
 88|com\.atlassian\.jira\.startup\.Launcher
 89|BitbucketServerLauncher
 90|com\.google\.gerrit\.pgm\.Daemon
 91|-Dsolr\.solr\.home=
 92|jenkins\.war)")
 93)
 94
 95
 96| where NOT (
 97    process_name="tasklist.exe"
 98    AND match(
 99        lower(process),
100        "^\"?tasklist(\.exe)?\"? +/fi +\"pid eq [0-9]+\" *$"
101    )
102)
103
104
105| where NOT (
106    (
107        match(parent_process_path, "(?i)^C:\\\\Program Files\\\\Datacard\\\\AppContainer\\\\bin\\\\tomcat.*\.exe$")
108        AND process_name="reg.exe"
109        AND match(
110            process,
111            "(?i)^reg query \"HKEY_LOCAL_MACHINE\\\\(SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Print\\\\Printers
112|SYSTEM\\\\CurrentControlSet\\\\Control\\\\Print\\\\Monitors)"
113        )
114    )
115    OR
116    (
117        match(parent_process_path, "(?i)^E:\\\\Program Files\\\\AeroScout\\\\MobileView\\\\services\\\\.*\\\\tomcat9\.exe$")
118        AND process_name="sc.exe"
119        AND match(process, "(?i)^sc qc (mv_[a-z-]+
120|mobileviewhttpserver)( [0-9]+)?$")
121    )
122)
123
124| `security_content_ctime(firstTime)`
125
126| `security_content_ctime(lastTime)`
127
128| `windows_suspicious_child_process_spawned_from_webserver_filter`