{"id":"2ea44a60-cfda-11ea-87d0-0242ac130003","title":"Webshell ReGeorg Detection Via Web Logs","description":"Certain strings in the uri_query field when combined with null referer and null user agent can indicate activity associated with the webshell ReGeorg.","author":"Cian Heasley","status":"test","level":"high","date":"2020-08-04","modified":"2023-01-02","tags":["attack.persistence","attack.t1505.003"],"technique_ids":["T1505.003"],"logsource":{"category":"webserver"},"falsepositives":["Web applications that use the same URL parameters as ReGeorg"],"references":["https://community.rsa.com/community/products/netwitness/blog/2019/02/19/web-shells-and-netwitness-part-3","https://github.com/sensepost/reGeorg"],"source_path":"rules/web/webserver_generic/web_webshell_regeorg.yml","source_sha256":"b76510bdb9979e1336957b3504aa9bf0bdb888989c601510daa7e65ced9642e2","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/web/webserver_generic/web_webshell_regeorg.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Webshell ReGeorg Detection Via Web Logs\nid: 2ea44a60-cfda-11ea-87d0-0242ac130003\nstatus: test\ndescription: Certain strings in the uri_query field when combined with null referer and null user agent can indicate activity associated with the webshell ReGeorg.\nreferences:\n    - https://community.rsa.com/community/products/netwitness/blog/2019/02/19/web-shells-and-netwitness-part-3\n    - https://github.com/sensepost/reGeorg\nauthor: Cian Heasley\ndate: 2020-08-04\nmodified: 2023-01-02\ntags:\n    - attack.persistence\n    - attack.t1505.003\nlogsource:\n    category: webserver\ndetection:\n    selection:\n        cs-uri-query|contains:\n            - 'cmd=read'\n            - 'connect&target'\n            - 'cmd=connect'\n            - 'cmd=disconnect'\n            - 'cmd=forward'\n    filter:\n        cs-referer: null\n        cs-user-agent: null\n        cs-method: POST\n    condition: selection and filter\nfalsepositives:\n    - Web applications that use the same URL parameters as ReGeorg\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1505.003","id":"T1505.003","name":"Web Shell","page":"techniques/enterprise/T1505.003/"}],"data_path":"data/detection-rules/2ea44a60-cfda-11ea-87d0-0242ac130003.json","kind":"sigma"}