{"id":"bed2a484-9348-4143-8a8a-b801c979301c","title":"Webshell Detection With Command Line Keywords","description":"Detects certain command line parameters often used during reconnaissance activity via web shells","author":"Florian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson","status":"test","level":"high","date":"2017-01-01","modified":"2024-12-14","tags":["attack.persistence","attack.discovery","attack.t1505.003","attack.t1018","attack.t1033","attack.t1087"],"technique_ids":["T1018","T1033","T1087","T1505.003"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-ii.html","https://unit42.paloaltonetworks.com/bumblebee-webshell-xhunt-campaign/","https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"],"source_path":"rules/windows/process_creation/proc_creation_win_webshell_recon_commands_and_processes.yml","source_sha256":"2db3e9674944cc3fe111ab792052016075465190d72c55eabf0e5670b9cae1a4","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_webshell_recon_commands_and_processes.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Webshell Detection With Command Line Keywords\nid: bed2a484-9348-4143-8a8a-b801c979301c\nstatus: test\ndescription: Detects certain command line parameters often used during reconnaissance activity via web shells\nreferences:\n    - https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-ii.html\n    - https://unit42.paloaltonetworks.com/bumblebee-webshell-xhunt-campaign/\n    - https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild\nauthor: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson\ndate: 2017-01-01\nmodified: 2024-12-14\ntags:\n    - attack.persistence\n    - attack.discovery\n    - attack.t1505.003\n    - attack.t1018\n    - attack.t1033\n    - attack.t1087\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_webserver_image:\n        ParentImage|endswith:\n            - '\\w3wp.exe'\n            - '\\php-cgi.exe'\n            - '\\nginx.exe'\n            - '\\httpd.exe'\n            - '\\caddy.exe'\n            - '\\ws_tomcatservice.exe'\n    selection_webserver_characteristics_tomcat1:\n        ParentImage|endswith:\n            - '\\java.exe'\n            - '\\javaw.exe'\n        ParentImage|contains:\n            - '-tomcat-'\n            - '\\tomcat'\n    selection_webserver_characteristics_tomcat2:\n        ParentImage|endswith:\n            - '\\java.exe'\n            - '\\javaw.exe'\n        CommandLine|contains:\n            - 'catalina.jar'\n            - 'CATALINA_HOME'\n    selection_susp_net_utility:\n        OriginalFileName:\n            - 'net.exe'\n            - 'net1.exe'\n        CommandLine|contains:\n            - ' user '\n            - ' use '\n            - ' group '\n    selection_susp_ping_utility:\n        OriginalFileName: 'ping.exe'\n        CommandLine|contains: ' -n '\n    selection_susp_change_dir:\n        CommandLine|contains:\n            - '&cd&echo'  # china chopper web shell\n            - 'cd /d '  # https://www.computerhope.com/cdhlp.htm\n    selection_susp_wmic_utility:\n        OriginalFileName: 'wmic.exe'\n        CommandLine|contains: ' /node:'\n    selection_susp_powershell_cli:\n        Image|endswith:\n            - '\\cmd.exe'\n            - '\\powershell.exe'\n            - '\\pwsh.exe'\n        CommandLine|contains:\n            - ' -enc '\n            - ' -EncodedCommand '\n            - ' -w hidden '\n            - ' -windowstyle hidden'\n            - '.WebClient).Download'\n    selection_susp_misc_discovery_binaries:\n        - Image|endswith:\n              - '\\dsquery.exe'\n              - '\\find.exe'\n              - '\\findstr.exe'\n              - '\\ipconfig.exe'\n              - '\\netstat.exe'\n              - '\\nslookup.exe'\n              - '\\pathping.exe'\n              - '\\quser.exe'\n              - '\\schtasks.exe'\n              - '\\systeminfo.exe'\n              - '\\tasklist.exe'\n              - '\\tracert.exe'\n              - '\\ver.exe'\n              - '\\wevtutil.exe'\n              - '\\whoami.exe'\n        - OriginalFileName:\n              - 'dsquery.exe'\n              - 'find.exe'\n              - 'findstr.exe'\n              - 'ipconfig.exe'\n              - 'netstat.exe'\n              - 'nslookup.exe'\n              - 'pathping.exe'\n              - 'quser.exe'\n              - 'schtasks.exe'\n              - 'sysinfo.exe'\n              - 'tasklist.exe'\n              - 'tracert.exe'\n              - 'ver.exe'\n              - 'VSSADMIN.EXE'\n              - 'wevtutil.exe'\n              - 'whoami.exe'\n    selection_susp_misc_discovery_commands:\n        CommandLine|contains:\n            - ' Test-NetConnection '\n            - 'dir \\'  # remote dir: dir \\<redacted IP #3>\\C$:\\windows\\temp\\*.exe\n    condition: 1 of selection_webserver_* and 1 of selection_susp_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1018","id":"T1018","name":"Remote System Discovery","page":"techniques/enterprise/T1018/"},{"key":"enterprise/T1033","id":"T1033","name":"System Owner/User Discovery","page":"techniques/enterprise/T1033/"},{"key":"enterprise/T1087","id":"T1087","name":"Account Discovery","page":"techniques/enterprise/T1087/"},{"key":"enterprise/T1505.003","id":"T1505.003","name":"Web Shell","page":"techniques/enterprise/T1505.003/"}],"data_path":"data/detection-rules/bed2a484-9348-4143-8a8a-b801c979301c.json","kind":"sigma"}