Chopper Webshell Process Pattern Detection

SigmaHQ Detections@sigmaHQ

•updated Apr 25, 2025•1•0•33

This rule detects process executions that exhibit patterns commonly associated with China Chopper-like tiny webshells, specifically when they are spawned by the w3wp.exe process (IIS worker process). The detection logic looks for specific command-line arguments that include common discovery and system information commands such as 'ipconfig', 'quser', 'whoami', 'c:', 'cd', 'dir', and echo commands, often used by webshells to interact with the compromised system.