{"id":"89c42960-f244-4dad-9151-ae9b1a3287a2","title":"Suspicious File Write to Webapps Root Directory","description":"Detects suspicious file writes to the root directory of web applications, particularly Apache web servers or Tomcat servers.\nThis may indicate an attempt to deploy malicious files such as web shells or other unauthorized scripts.\n","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2025-10-20","modified":"","tags":["attack.persistence","attack.t1505.003","attack.initial-access","attack.t1190"],"technique_ids":["T1190","T1505.003"],"logsource":{"product":"windows","category":"file_event"},"falsepositives":["Unknown"],"references":["https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/"],"source_path":"rules/windows/file/file_event/file_event_win_susp_file_write_in_webapps_root.yml","source_sha256":"e3836ebbb828f19a2fa13d3fe1fcb979a258cf5b65d00e6c5d6a52168aa48b04","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_susp_file_write_in_webapps_root.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious File Write to Webapps Root Directory\nid: 89c42960-f244-4dad-9151-ae9b1a3287a2\nstatus: experimental\ndescription: |\n    Detects suspicious file writes to the root directory of web applications, particularly Apache web servers or Tomcat servers.\n    This may indicate an attempt to deploy malicious files such as web shells or other unauthorized scripts.\nreferences:\n    - https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2025-10-20\ntags:\n    - attack.persistence\n    - attack.t1505.003\n    - attack.initial-access\n    - attack.t1190\nlogsource:\n    product: windows\n    category: file_event\ndetection:\n    # Add more suspicious processes or paths or extensions as needed\n    selection_susp_img:\n        Image|endswith:\n            - '\\dotnet.exe'\n            - '\\w3wp.exe'\n            - '\\java.exe'\n    selection_servers:\n        TargetFilename|contains:\n            - '\\apache'\n            - '\\tomcat'\n    selection_path:\n        TargetFilename|contains: '\\webapps\\ROOT\\'\n    selection_susp_extensions:\n        TargetFilename|endswith: '.jsp'\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1190","id":"T1190","name":"Exploit Public-Facing Application","page":"techniques/enterprise/T1190/"},{"key":"enterprise/T1505.003","id":"T1505.003","name":"Web Shell","page":"techniques/enterprise/T1505.003/"}],"data_path":"data/detection-rules/89c42960-f244-4dad-9151-ae9b1a3287a2.json","kind":"sigma"}