{"id":"818f7b24-0fba-4c49-a073-8b755573b9c7","title":"Linux Webshell Indicators","description":"Detects suspicious sub processes of web server processes","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2021-10-15","modified":"2022-12-28","tags":["attack.persistence","attack.t1505.003"],"technique_ids":["T1505.003"],"logsource":{"product":"linux","category":"process_creation"},"falsepositives":["Web applications that invoke Linux command line tools"],"references":["https://www.acunetix.com/blog/articles/web-shells-101-using-php-introduction-web-shells-part-2/","https://media.defense.gov/2020/Jun/09/2002313081/-1/-1/0/CSI-DETECT-AND-PREVENT-WEB-SHELL-MALWARE-20200422.PDF"],"source_path":"rules/linux/process_creation/proc_creation_lnx_webshell_detection.yml","source_sha256":"f06ebe5127af93986a01d17b1ddbbf3d52f54b8eb2a65e1934784855dbd12f71","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_webshell_detection.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Linux Webshell Indicators\nid: 818f7b24-0fba-4c49-a073-8b755573b9c7\nstatus: test\ndescription: Detects suspicious sub processes of web server processes\nreferences:\n    - https://www.acunetix.com/blog/articles/web-shells-101-using-php-introduction-web-shells-part-2/\n    - https://media.defense.gov/2020/Jun/09/2002313081/-1/-1/0/CSI-DETECT-AND-PREVENT-WEB-SHELL-MALWARE-20200422.PDF\nauthor: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)\ndate: 2021-10-15\nmodified: 2022-12-28\ntags:\n    - attack.persistence\n    - attack.t1505.003\nlogsource:\n    product: linux\n    category: process_creation\ndetection:\n    selection_general:\n        ParentImage|endswith:\n            - '/httpd'\n            - '/lighttpd'\n            - '/nginx'\n            - '/apache2'\n            - '/node'\n            - '/caddy'\n    selection_tomcat:\n        ParentCommandLine|contains|all:\n            - '/bin/java'\n            - 'tomcat'\n    selection_websphere:  # ? just guessing\n        ParentCommandLine|contains|all:\n            - '/bin/java'\n            - 'websphere'\n    sub_processes:\n        Image|endswith:\n            - '/whoami'\n            - '/ifconfig'\n            - '/ip'\n            - '/bin/uname'\n            - '/bin/cat'\n            - '/bin/crontab'\n            - '/hostname'\n            - '/iptables'\n            - '/netstat'\n            - '/pwd'\n            - '/route'\n    condition: 1 of selection_* and sub_processes\nfalsepositives:\n    - Web applications that invoke Linux command line tools\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1505.003","id":"T1505.003","name":"Web Shell","page":"techniques/enterprise/T1505.003/"}],"data_path":"data/detection-rules/818f7b24-0fba-4c49-a073-8b755573b9c7.json","kind":"sigma"}