T1505.003 Web Shell — Detection Rules

Source-backed rule directory

• Antivirus Web Shell Detection · test · high · {"category":"antivirus"}
• Webshell Remote Command Execution · test · critical · {"product":"linux","service":"auditd","definition":"Required auditd configuration:\n-a always,exit -F arch=b32 -S execve -F euid=33 -k detect_execve_www\n-a always,exit -F arch=b64 -S execve -F euid=33 -k detect_execve_www\n-a always,exit -F arch=b32 -S execveat -F euid=33 -k detect_execve_www\n-a always,exit -F arch=b64 -S execveat -F euid=33 -k detect_execve_www\nChange the number \"33\" to the ID of your WebServer user. Default: www-data:x:33:33\n"}
• Shellshock Expression · test · high · {"product":"linux"}
• Linux Webshell Indicators · test · high · {"product":"linux","category":"process_creation"}
• Suspicious Windows Strings In URI · test · high · {"category":"webserver"}
• Webshell ReGeorg Detection Via Web Logs · test · high · {"category":"webserver"}
• Windows Webshell Strings · test · high · {"category":"webserver"}
• Certificate Request Export to Exchange Webserver · test · critical · {"service":"msexchange-management","product":"windows"}
• Mailbox Export to Exchange Webserver · test · critical · {"service":"msexchange-management","product":"windows"}
• Exchange Set OabVirtualDirectory ExternalUrl Property · test · high · {"product":"windows","service":"msexchange-management"}
• Suspicious ASPX File Drop by Exchange · test · high · {"product":"windows","category":"file_event"}
• Suspicious File Drop by Exchange · test · medium · {"product":"windows","category":"file_event"}
• Suspicious MSExchangeMailboxReplication ASPX Write · test · high · {"product":"windows","category":"file_event"}
• Suspicious File Write to Webapps Root Directory · experimental · medium · {"product":"windows","category":"file_event"}
• Suspicious File Write to SharePoint Layouts Directory · experimental · high · {"product":"windows","category":"file_event"}
• Potential Webshell Creation On Static Website · test · medium · {"product":"windows","category":"file_event"}
• IIS Native-Code Module Command Line Installation · test · medium · {"category":"process_creation","product":"windows"}
• Suspicious Child Process Of SQL Server · test · high · {"category":"process_creation","product":"windows"}
• Chopper Webshell Process Pattern · test · high · {"category":"process_creation","product":"windows"}
• Webshell Hacking Activity Patterns · test · high · {"category":"process_creation","product":"windows"}
• Webshell Detection With Command Line Keywords · test · high · {"category":"process_creation","product":"windows"}
• Suspicious Process By Web Server Process · test · high · {"category":"process_creation","product":"windows"}
• Webshell Tool Reconnaissance Activity · test · high · {"category":"process_creation","product":"windows"}

Atlas deterministic concepts

T1505.003 Web Shell

MATCH(new_or_modified_file IN web_root) AND extension IN executable_server_extensions -> ALERT; SEQUENCE(web_request, web_server_child_process) WITHIN 1m -> ALERT

• File-Integrity Monitoring Logs
• Web Server Access Logs
• Process Execution Logs
• Atlas source section

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0394 Web Shell Detection via Server Behavior and File Execution Chains

AN1108 Analytic 1108

Unexpected file creation in web directories followed by web server processes (e.g., w3wp.exe) spawning command shells or script interpreters (e.g., cmd.exe, powershell.exe)

AN1109 Analytic 1109

File creation of unauthorized script (e.g., .php, .sh) in /var/www/html followed by execution of unexpected system utilities (e.g., curl, bash, nc) by apache/nginx

AN1110 Analytic 1110

Web servers (e.g., httpd) spawning abnormal processes post file upload into /Library/WebServer/Documents or /usr/local/var/www