{"id":"f64e5c19-879c-4bae-b471-6d84c8339677","title":"Webshell Tool Reconnaissance Activity","description":"Detects processes spawned from web servers (PHP, Tomcat, IIS, etc.) that perform reconnaissance looking for the existence of popular scripting tools (perl, python, wget) on the system via the help commands\n","author":"Cian Heasley, Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2020-07-22","modified":"2023-11-09","tags":["attack.persistence","attack.t1505.003"],"technique_ids":["T1505.003"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://ragged-lab.blogspot.com/2020/07/webshells-automating-reconnaissance.html"],"source_path":"rules/windows/process_creation/proc_creation_win_webshell_tool_recon.yml","source_sha256":"ebb6955781783f6394bc7887940068b68f8f028996ee97ba426137152afa50c1","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_webshell_tool_recon.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Webshell Tool Reconnaissance Activity\nid: f64e5c19-879c-4bae-b471-6d84c8339677\nstatus: test\ndescription: |\n    Detects processes spawned from web servers (PHP, Tomcat, IIS, etc.) that perform reconnaissance looking for the existence of popular scripting tools (perl, python, wget) on the system via the help commands\nreferences:\n    - https://ragged-lab.blogspot.com/2020/07/webshells-automating-reconnaissance.html\nauthor: Cian Heasley, Florian Roth (Nextron Systems)\ndate: 2020-07-22\nmodified: 2023-11-09\ntags:\n    - attack.persistence\n    - attack.t1505.003\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_webserver_image:\n        ParentImage|endswith:\n            - '\\caddy.exe'\n            - '\\httpd.exe'\n            - '\\nginx.exe'\n            - '\\php-cgi.exe'\n            - '\\w3wp.exe'\n            - '\\ws_tomcatservice.exe'\n    selection_webserver_characteristics_tomcat1:\n        ParentImage|endswith:\n            - '\\java.exe'\n            - '\\javaw.exe'\n        ParentImage|contains:\n            - '-tomcat-'\n            - '\\tomcat'\n    selection_webserver_characteristics_tomcat2:\n        ParentImage|endswith:\n            - '\\java.exe'\n            - '\\javaw.exe'\n        CommandLine|contains:\n            - 'CATALINA_HOME'\n            - 'catalina.jar'\n    selection_recon:\n        CommandLine|contains:\n            - 'perl --help'\n            - 'perl -h'\n            - 'python --help'\n            - 'python -h'\n            - 'python3 --help'\n            - 'python3 -h'\n            - 'wget --help'\n    condition: 1 of selection_webserver_* and selection_recon\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1505.003","id":"T1505.003","name":"Web Shell","page":"techniques/enterprise/T1505.003/"}],"data_path":"data/detection-rules/f64e5c19-879c-4bae-b471-6d84c8339677.json","kind":"sigma"}