BIOC Informational

Web server process drops an executable to disk

Web server processes should not normally write executable files out to the local filesystem. This may have legitimate uses in certain web applications, yet check for possible exploitation of the hosted web application.

Module:
Platform Analytics
Agent event type:
File
Category:
Dropper
Status:
Enabled
ATT&CK tactics: Initial Access (TA0001)
ATT&CK techniques: Exploit Public-Facing Application (T1190)
Indicator:

File file name = *.exe , *.scr , *.dll , *.sys , *.com , *.bin , *.msi AND action type = create Process initiated by = w3wp.exe , httpd.exe , nginx.exe , php-cgi.exe , initiated by = *apache* , *tomcat*

Preventable: yes