Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Stormous – Web Shell Persistence via IIS Component

Stormous Persistence Sentinel
MITRE ATT&CK
Web Shell
Data Source
DeviceProcessEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live ttps dataset (stormous)
What This Detects
Stormous's TTPs include web-shell-based persistence on compromised web servers – flags a web application process spawning a shell/script engine, or a new web-shell-shaped file dropped into a web root.
Query
DeviceProcessEvents
| where Timestamp > ago(1d)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where FileName in~ ("cmd.exe","powershell.exe","cscript.exe")
| project Timestamp, DeviceName, ProcessCommandLine, InitiatingProcessFileName, AccountName
| union (
    DeviceFileEvents
    | where Timestamp > ago(1d)
    | where FolderPath has_any ("wwwroot","inetpub")
    | where FileName endswith ".aspx" or FileName endswith ".php"
    | where ActionType == "FileCreated"
)

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.