{"id":"c0d3734d-330f-4a03-aae2-65dacc6a8222","title":"Webshell Remote Command Execution","description":"Detects possible command execution by web application/web shell","author":"Ilyas Ochkov, Beyu Denis, oscd.community","status":"test","level":"critical","date":"2019-10-12","modified":"2025-12-05","tags":["attack.persistence","attack.t1505.003"],"technique_ids":["T1505.003"],"logsource":{"product":"linux","service":"auditd","definition":"Required auditd configuration:\n-a always,exit -F arch=b32 -S execve -F euid=33 -k detect_execve_www\n-a always,exit -F arch=b64 -S execve -F euid=33 -k detect_execve_www\n-a always,exit -F arch=b32 -S execveat -F euid=33 -k detect_execve_www\n-a always,exit -F arch=b64 -S execveat -F euid=33 -k detect_execve_www\nChange the number \"33\" to the ID of your WebServer user. Default: www-data:x:33:33\n"},"falsepositives":["Admin activity","Crazy web applications"],"references":["Personal Experience of the Author","https://www.vaadata.com/blog/what-is-command-injection-exploitations-and-security-best-practices/"],"source_path":"rules/linux/auditd/syscall/lnx_auditd_web_rce.yml","source_sha256":"9ef1058a926418eaf66f478fe4dfbbd8bd7a58b6e223ea761a06150227295e50","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/syscall/lnx_auditd_web_rce.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Webshell Remote Command Execution\nid: c0d3734d-330f-4a03-aae2-65dacc6a8222\nstatus: test\ndescription: Detects possible command execution by web application/web shell\nreferences:\n    - Personal Experience of the Author\n    - https://www.vaadata.com/blog/what-is-command-injection-exploitations-and-security-best-practices/\nauthor: Ilyas Ochkov, Beyu Denis, oscd.community\ndate: 2019-10-12\nmodified: 2025-12-05\ntags:\n    - attack.persistence\n    - attack.t1505.003\nlogsource:\n    product: linux\n    service: auditd\n    definition: |\n        Required auditd configuration:\n        -a always,exit -F arch=b32 -S execve -F euid=33 -k detect_execve_www\n        -a always,exit -F arch=b64 -S execve -F euid=33 -k detect_execve_www\n        -a always,exit -F arch=b32 -S execveat -F euid=33 -k detect_execve_www\n        -a always,exit -F arch=b64 -S execveat -F euid=33 -k detect_execve_www\n        Change the number \"33\" to the ID of your WebServer user. Default: www-data:x:33:33\ndetection:\n    selection:\n        type: 'SYSCALL'\n        SYSCALL:\n            - 'execve'\n            - 'execveat'\n        euid: 33\n    condition: selection\nfalsepositives:\n    - Admin activity\n    - Crazy web applications\nlevel: critical\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1505.003","id":"T1505.003","name":"Web Shell","page":"techniques/enterprise/T1505.003/"}],"data_path":"data/detection-rules/c0d3734d-330f-4a03-aae2-65dacc6a8222.json","kind":"sigma"}