{"id":"4ebc877f-4612-45cb-b3a5-8e3834db36c9","title":"Webshell Hacking Activity Patterns","description":"Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system\n","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-03-17","modified":"2023-11-09","tags":["attack.persistence","attack.discovery","attack.t1505.003","attack.t1018","attack.t1033","attack.t1087"],"technique_ids":["T1018","T1033","T1087","T1505.003"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unlikely"],"references":["https://youtu.be/7aemGhaE9ds?t=641"],"source_path":"rules/windows/process_creation/proc_creation_win_webshell_hacking.yml","source_sha256":"7e798383219b76b934c3cd5b78117896600c70eb46e2f00d01f79e3f1059e39c","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_webshell_hacking.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Webshell Hacking Activity Patterns\nid: 4ebc877f-4612-45cb-b3a5-8e3834db36c9\nstatus: test\ndescription: |\n    Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system\nreferences:\n    - https://youtu.be/7aemGhaE9ds?t=641\nauthor: Florian Roth (Nextron Systems)\ndate: 2022-03-17\nmodified: 2023-11-09\ntags:\n    - attack.persistence\n    - attack.discovery\n    - attack.t1505.003\n    - attack.t1018\n    - attack.t1033\n    - attack.t1087\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n   # Webserver\n    selection_webserver_image:\n        ParentImage|endswith:\n            - '\\caddy.exe'\n            - '\\httpd.exe'\n            - '\\nginx.exe'\n            - '\\php-cgi.exe'\n            - '\\w3wp.exe'\n            - '\\ws_tomcatservice.exe'\n    selection_webserver_characteristics_tomcat1:\n        ParentImage|endswith:\n            - '\\java.exe'\n            - '\\javaw.exe'\n        ParentImage|contains:\n            - '-tomcat-'\n            - '\\tomcat'\n    selection_webserver_characteristics_tomcat2:\n        ParentImage|endswith:\n            - '\\java.exe'\n            - '\\javaw.exe'\n        CommandLine|contains:\n            - 'catalina.jar'\n            - 'CATALINA_HOME'\n    # Suspicious child processes\n    selection_child_1:\n        # Process dumping\n        CommandLine|contains|all:\n            - 'rundll32'\n            - 'comsvcs'\n    selection_child_2:\n        # Winrar exfil\n        CommandLine|contains|all:\n            - ' -hp'\n            - ' a '\n            - ' -m'\n    selection_child_3:\n        # User add\n        CommandLine|contains|all:\n            - 'net'\n            - ' user '\n            - ' /add'\n    selection_child_4:\n        CommandLine|contains|all:\n            - 'net'\n            - ' localgroup '\n            - ' administrators '\n            - '/add'\n    selection_child_5:\n        Image|endswith:\n            # Credential stealing\n            - '\\ntdsutil.exe'\n            # AD recon\n            - '\\ldifde.exe'\n            - '\\adfind.exe'\n            # Process dumping\n            - '\\procdump.exe'\n            - '\\Nanodump.exe'\n            # Destruction / ransom groups\n            - '\\vssadmin.exe'\n            - '\\fsutil.exe'\n    selection_child_6:\n        # SUspicious patterns\n        CommandLine|contains:\n            - ' -decode '  # Used with certutil\n            - ' -NoP '  # Often used in malicious PowerShell commands\n            - ' -W Hidden '  # Often used in malicious PowerShell commands\n            - ' /decode '  # Used with certutil\n            - ' /ticket:'  # Rubeus\n            - ' sekurlsa'  # Mimikatz\n            - '.dmp full'  # Process dumping method apart from procdump\n            - '.downloadfile('  # PowerShell download command\n            - '.downloadstring('  # PowerShell download command\n            - 'FromBase64String' # PowerShell encoded payload\n            - 'process call create' # WMIC process creation\n            - 'reg save '  # save registry SAM - syskey extraction\n            - 'whoami /priv'\n    condition: 1 of selection_webserver_* and 1 of selection_child_*\nfalsepositives:\n    - Unlikely\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1018","id":"T1018","name":"Remote System Discovery","page":"techniques/enterprise/T1018/"},{"key":"enterprise/T1033","id":"T1033","name":"System Owner/User Discovery","page":"techniques/enterprise/T1033/"},{"key":"enterprise/T1087","id":"T1087","name":"Account Discovery","page":"techniques/enterprise/T1087/"},{"key":"enterprise/T1505.003","id":"T1505.003","name":"Web Shell","page":"techniques/enterprise/T1505.003/"}],"data_path":"data/detection-rules/4ebc877f-4612-45cb-b3a5-8e3834db36c9.json","kind":"sigma"}