Spotting Web Shell Execution: Web Server Spawning Suspicious Child Processes

When adversaries exploit vulnerabilities in web applications (e.g., Log4j, ProxyLogon, file upload flaws), their initial post-exploitation step is dropping a web shell. Once loaded, the web server process (such as IIS w3wp.exe or Apache httpd.exe) spawns shell interpreters to run system enumeration commands.

In legitimate operations, web servers should virtually never spawn command interpreters.

Log Source

• Microsoft Defender for Endpoint: DeviceProcessEvents

Web Shell KQL Detection Query

// Detect Web Servers Spawning Command Shells and System Reconnaissance Utilities
let timeRange = 7d;
let webServerProcesses = dynamic([
    "w3wp.exe",
    "httpd.exe",
    "nginx.exe",
    "tomcat.exe",
    "php-cgi.exe",
    "java.exe"
]);
let suspiciousChildren = dynamic([
    "cmd.exe",
    "powershell.exe",
    "pwsh.exe",
    "whoami.exe",
    "net.exe",
    "net1.exe",
    "quser.exe",
    "nltest.exe",
    "certutil.exe",
    "bitsadmin.exe"
]);
DeviceProcessEvents
| where TimeGenerated >= ago(timeRange)
| where InitiatingProcessFileName in~ (webServerProcesses)
| where FileName in~ (suspiciousChildren)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| order by TimeGenerated desc

Immediate Validation Steps

• Inspect ProcessCommandLine for reconnaissance patterns such as whoami /all, net user, or download attempts via certutil -urlcache.
• Check InitiatingProcessCommandLine to locate the exact IIS Application Pool or virtual directory being abused.
• Quarantine the endpoint and isolate the uploaded .aspx, .php, or .jsp web shell file.

MITRE ATT&CK Mapping

• Tactic: Persistence (TA0003), Initial Access (TA0001), Execution (TA0002)
• Technique: Server Software Component: Web Shell (T1505.003)