BIOC
Informational
✕
Web server process drops an executable to disk
Web server processes should not normally write executable files out to the local filesystem. This may have legitimate uses in certain web applications, yet check for possible exploitation of the hosted web application.
- Module:
- Platform Analytics
- Agent event type:
- File
- Category:
- Dropper
- Status:
- Enabled
ATT&CK tactics: Initial Access (TA0001)
ATT&CK techniques: Exploit Public-Facing Application (T1190)
Indicator:
File file name = *.exe , *.scr , *.dll , *.sys , *.com , *.bin , *.msi AND action type = create Process initiated by = w3wp.exe , httpd.exe , nginx.exe , php-cgi.exe , initiated by = *apache* , *tomcat*
Preventable: yes