detect-suspicious-commands-initiated-by-web-server-processes

Hunt Hypothesis

Web server processes executing suspicious commands may indicate an adversary leveraging compromised server infrastructure to exfiltrate data or establish persistence. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential lateral movement or data exfiltration attempts originating from trusted web services.

KQL Query

// Suspicious commands launched by web server processes
DeviceProcessEvents 
| where Timestamp > ago(7d)
// Pivoting on parents or grand parents
and (((InitiatingProcessParentFileName in("w3wp.exe", "beasvc.exe",
"httpd.exe") or InitiatingProcessParentFileName startswith "tomcat")
or InitiatingProcessFileName in("w3wp.exe", "beasvc.exe", "httpd.exe") or
InitiatingProcessFileName startswith "tomcat"))
    and FileName in~('cmd.exe','powershell.exe')
| where ProcessCommandLine contains '%temp%'
    or ProcessCommandLine has 'wget'
    or ProcessCommandLine has 'whoami'
    or ProcessCommandLine has 'certutil'
    or ProcessCommandLine has 'systeminfo'
    or ProcessCommandLine has 'ping'
    or ProcessCommandLine has 'ipconfig'
    or ProcessCommandLine has 'timeout'
| summarize any(Timestamp), any(Timestamp), any(FileName),
makeset(ProcessCommandLine), any(InitiatingProcessFileName),
any(InitiatingProcessParentFileName) by DeviceId

Analytic Rule Definition

id: 7fdc5f4a-700d-4713-abfc-181f02968726
name: detect-suspicious-commands-initiated-by-web-server-processes
description: |
  This query was originally published in the threat analytics report, Operation Soft Cell.
  Operation Soft Cell is a series of campaigns targeting users' call logs at telecommunications providers throughout the world. These attacks date from as early as 2012.
  Operation Soft Cell operators sometimes use legitimate web server processes to launch commands, especially for network discovery and user/owner discovery. The following query detects activity of this kind.
  Reference - https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Execution
- Defense evasion
- Discovery
query: |
  // Suspicious commands launched by web server processes
  DeviceProcessEvents 
  | where Timestamp > ago(7d)
  // Pivoting on parents or grand parents
  and (((InitiatingProcessParentFileName in("w3wp.exe", "beasvc.exe",
  "httpd.exe") or InitiatingProcessParentFileName startswith "tomcat")
  or InitiatingProcessFileName in("w3wp.exe", "beasvc.exe", "httpd.exe") or
  InitiatingProcessFileName startswith "tomcat"))
      and FileName in~('cmd.exe','powershell.exe')
  | where ProcessCommandLine contains '%temp%'
      or ProcessCommandLine has 'wget'
      or ProcessCommandLine has 'whoami'
      or ProcessCommandLine has 'certutil'
      or ProcessCommandLine has 'systeminfo'
      or ProcessCommandLine has 'ping'
      or ProcessCommandLine has 'ipconfig'
      or ProcessCommandLine has 'timeout'
  | summarize any(Timestamp), any(Timestamp), any(FileName),
  makeset(ProcessCommandLine), any(InitiatingProcessFileName),
  any(InitiatingProcessParentFileName) by DeviceId

Required Data Sources

MITRE ATT&CK Context

• Tactic: Execution
• Tactic: Defense evasion
• Tactic: Discovery

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Discovery/detect-suspicious-commands-initiated-by-web-server-processes.yaml)

False Positive Guidance

• Scenario: Web server process executing a legitimate system maintenance script
  Description: A web server process (e.g., Apache or Nginx) may run a scheduled maintenance script (e.g., cron job) that performs routine tasks like log rotation or database backups.
  Filter/Exclusion: Exclude processes associated with known maintenance scripts (e.g., /usr/sbin/logrotate, /bin/cron, or specific cron job paths). Use a filter like:

  process.name IN ("logrotate", "cron", "systemd-tmpfiles-setup")

• Scenario: Web application using a command-line tool for data processing
  Description: A web application (e.g., using PHP, Python, or Node.js) may invoke a command-line tool (e.g., ffmpeg, rsync, or tar) as part of its normal operation, such as processing media files or archiving data.
  Filter/Exclusion: Exclude known command-line tools used by web apps (e.g., ffmpeg, rsync, tar, or gzip). Use a filter like:

  process.name IN ("ffmpeg", "rsync", "tar", "gzip")

• Scenario: Web server process running a scheduled backup job
  Description: A web server may run a scheduled backup job (e.g., using mysqldump, pg_dump, or a third-party tool like Duplicity) to back up databases or files.
  Filter/Exclusion: Exclude processes related to backup tools (e.g., mysqldump, pg_dump, duplicity). Use a filter like:

  process.name IN ("mysqldump", "pg_dump", "duplicity")

• **Scenario: Web server process executing a