AN1108
Analytic 1108
Windows
Unexpected file creation in web directories followed by web server processes (e.g., w3wp.exe) spawning command shells or script interpreters (e.g., cmd.exe, powershell.exe)
WinEventLog:Sysmon
EventCode=11
WinEventLog:Sysmon
EventCode=1
WinEventLog:Security
EventCode=4624, 4648
NSM:Flow
Inbound HTTP POST with suspicious payload size or user-agent
[WebRootPath]
Custom web server directory depending on IIS or third-party hosting environment
[ParentProcess]
Different server binaries (e.g., php-cgi.exe, apache.exe) that may launch scripts
AN1109
Analytic 1109
Linux
File creation of unauthorized script (e.g., .php, .sh) in /var/www/html followed by execution of unexpected system utilities (e.g., curl, bash, nc) by apache/nginx
auditd:SYSCALL
new file created in /var/www/html, /srv/http, or similar web root
auditd:SYSCALL
apache2 or nginx spawning sh, bash, or python interpreter
NSM:Flow
POST requests to .php, .jsp, .aspx files with high entropy body
[WebRootPath]
Web server root varies by distro and hosting configuration
[PayloadEntropyThreshold]
Base64 or XOR encoded shells may exceed this value
[TimeWindow]
Correlate file creation with process spawn within X seconds
AN1110
Analytic 1110
macOS
Web servers (e.g., httpd) spawning abnormal processes post file upload into /Library/WebServer/Documents or /usr/local/var/www
macos:unifiedlog
httpd spawning bash, zsh, python, or osascript
auditd:SYSCALL
file write operations in /Library/WebServer/Documents
[InterpreterName]
Adversary may use different scripting environments
[ExecutionParent]
Not all web servers are named httpd; may differ in custom deployments