{"id":"39f1f9f2-9636-45de-98f6-a4046aa8e4b9","title":"Potential Webshell Creation On Static Website","description":"Detects the creation of files with certain extensions on a static web site. This can be indicative of potential uploads of a web shell.","author":"Beyu Denis, oscd.community, Tim Shelton, Thurein Oo","status":"test","level":"medium","date":"2019-10-22","modified":"2023-10-15","tags":["attack.persistence","attack.t1505.003"],"technique_ids":["T1505.003"],"logsource":{"product":"windows","category":"file_event"},"falsepositives":["Legitimate administrator or developer creating legitimate executable files in a web application folder"],"references":["PT ESC rule and personal experience","https://github.com/swisskyrepo/PayloadsAllTheThings/blob/c95a0a1a2855dc0cd7f7327614545fe30482a636/Upload%20Insecure%20Files/README.md"],"source_path":"rules/windows/file/file_event/file_event_win_webshell_creation_detect.yml","source_sha256":"1ef5bd9523ce73da987b1097c9d470abf380f3a8882d11dda1ed6c2d348098cc","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_webshell_creation_detect.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Webshell Creation On Static Website\nid: 39f1f9f2-9636-45de-98f6-a4046aa8e4b9\nstatus: test\ndescription: Detects the creation of files with certain extensions on a static web site. This can be indicative of potential uploads of a web shell.\nreferences:\n    - PT ESC rule and personal experience\n    - https://github.com/swisskyrepo/PayloadsAllTheThings/blob/c95a0a1a2855dc0cd7f7327614545fe30482a636/Upload%20Insecure%20Files/README.md\nauthor: Beyu Denis, oscd.community, Tim Shelton, Thurein Oo\ndate: 2019-10-22\nmodified: 2023-10-15\ntags:\n    - attack.persistence\n    - attack.t1505.003\nlogsource:\n    product: windows\n    category: file_event\ndetection:\n    selection_wwwroot_path:\n        TargetFilename|contains: '\\inetpub\\wwwroot\\'\n    selection_wwwroot_ext:\n        TargetFilename|contains:\n            - '.ashx'\n            - '.asp'\n            - '.ph'\n            - '.soap'\n    selection_htdocs_path:\n        TargetFilename|contains:\n            - '\\www\\'\n            - '\\htdocs\\'\n            - '\\html\\'\n    selection_htdocs_ext:\n        TargetFilename|contains: '.ph'\n    # selection_tomcat_path:\n    #     TargetFilename|contains: '\\webapps\\ROOT'\n    # selection_tomcat_ext:\n    #     TargetFilename|contains:\n    #         - '.jsp' # .jspx, .jspf\n    #         - '.jsv'\n    #         - '.jsw'\n    filter_main_temp:  # FP when unpacking some executables in $TEMP\n        TargetFilename|contains:\n            - '\\AppData\\Local\\Temp\\'\n            - '\\Windows\\Temp\\'\n    filter_main_system:\n        Image: 'System' # FP when backup/restore from drivers\n    filter_main_legitimate:\n        TargetFilename|contains: '\\xampp'\n    condition: (all of selection_wwwroot_* or all of selection_htdocs_*) and not 1 of filter_main_*\nfalsepositives:\n    - Legitimate administrator or developer creating legitimate executable files in a web application folder\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1505.003","id":"T1505.003","name":"Web Shell","page":"techniques/enterprise/T1505.003/"}],"data_path":"data/detection-rules/39f1f9f2-9636-45de-98f6-a4046aa8e4b9.json","kind":"sigma"}