{"id":"7ff9db12-1b94-4a79-ba68-a2402c5d6729","title":"Windows Webshell Strings","description":"Detects common commands used in Windows webshells","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2017-02-19","modified":"2022-11-18","tags":["attack.persistence","attack.t1505.003"],"technique_ids":["T1505.003"],"logsource":{"category":"webserver"},"falsepositives":["Web sites like wikis with articles on os commands and pages that include the os commands in the URLs","User searches in search boxes of the respective website"],"references":["https://bad-jubies.github.io/RCE-NOW-WHAT/","https://m365internals.com/2022/10/07/hunting-in-on-premises-exchange-server-logs/"],"source_path":"rules/web/webserver_generic/web_win_webshells_in_access_logs.yml","source_sha256":"8d919a9c208ef9060dfc10e81c9ae48c91b42d37af64b3a8ca156ed42e07d9e2","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/web/webserver_generic/web_win_webshells_in_access_logs.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Windows Webshell Strings\nid: 7ff9db12-1b94-4a79-ba68-a2402c5d6729\nstatus: test\ndescription: Detects common commands used in Windows webshells\nreferences:\n    - https://bad-jubies.github.io/RCE-NOW-WHAT/\n    - https://m365internals.com/2022/10/07/hunting-in-on-premises-exchange-server-logs/\nauthor: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)\ndate: 2017-02-19\nmodified: 2022-11-18\ntags:\n    - attack.persistence\n    - attack.t1505.003\nlogsource:\n    category: webserver\ndetection:\n    selection_method:\n        cs-method: 'GET'\n    selection_keywords:\n        # The \"%20\" is URL encoded version of the space\n        # The \"%2B\" is URL encoded version of the \"+\"\n        - '=whoami'\n        - '=net%20user'\n        - '=net+user'\n        - '=net%2Buser'\n        - '=cmd%20/c%'\n        - '=cmd+/c+'\n        - '=cmd%2B/c%'\n        - '=cmd%20/r%'\n        - '=cmd+/r+'\n        - '=cmd%2B/r%'\n        - '=cmd%20/k%'\n        - '=cmd+/k+'\n        - '=cmd%2B/k%'\n        - '=powershell%'\n        - '=powershell+'\n        - '=tasklist%'\n        - '=tasklist+'\n        - '=wmic%'\n        - '=wmic+'\n        - '=ssh%'\n        - '=ssh+'\n        - '=python%'\n        - '=python+'\n        - '=python3%'\n        - '=python3+'\n        - '=ipconfig'\n        - '=wget%'\n        - '=wget+'\n        - '=curl%'\n        - '=curl+'\n        - '=certutil'\n        - '=copy%20%5C%5C'\n        - '=dsquery%'\n        - '=dsquery+'\n        - '=nltest%'\n        - '=nltest+'\n    condition: all of selection_*\nfalsepositives:\n    - Web sites like wikis with articles on os commands and pages that include the os commands in the URLs\n    - User searches in search boxes of the respective website\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1505.003","id":"T1505.003","name":"Web Shell","page":"techniques/enterprise/T1505.003/"}],"data_path":"data/detection-rules/7ff9db12-1b94-4a79-ba68-a2402c5d6729.json","kind":"sigma"}