Webshell Remote Command Execution — Sigma Rule

Rule metadata and linked tags

Author: Ilyas Ochkov, Beyu Denis, oscd.community. Source status: test; severity: critical. Source dates: 2019-10-12 / 2025-12-05.

{
  "product": "linux",
  "service": "auditd",
  "definition": "Required auditd configuration:\n-a always,exit -F arch=b32 -S execve -F euid=33 -k detect_execve_www\n-a always,exit -F arch=b64 -S execve -F euid=33 -k detect_execve_www\n-a always,exit -F arch=b32 -S execveat -F euid=33 -k detect_execve_www\n-a always,exit -F arch=b64 -S execveat -F euid=33 -k detect_execve_www\nChange the number \"33\" to the ID of your WebServer user. Default: www-data:x:33:33\n"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 9ef1058a926418eaf66f478fe4dfbbd8bd7a58b6e223ea761a06150227295e50

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Webshell Remote Command Execution
id: c0d3734d-330f-4a03-aae2-65dacc6a8222
status: test
description: Detects possible command execution by web application/web shell
references:
    - Personal Experience of the Author
    - https://www.vaadata.com/blog/what-is-command-injection-exploitations-and-security-best-practices/
author: Ilyas Ochkov, Beyu Denis, oscd.community
date: 2019-10-12
modified: 2025-12-05
tags:
    - attack.persistence
    - attack.t1505.003
logsource:
    product: linux
    service: auditd
    definition: |
        Required auditd configuration:
        -a always,exit -F arch=b32 -S execve -F euid=33 -k detect_execve_www
        -a always,exit -F arch=b64 -S execve -F euid=33 -k detect_execve_www
        -a always,exit -F arch=b32 -S execveat -F euid=33 -k detect_execve_www
        -a always,exit -F arch=b64 -S execveat -F euid=33 -k detect_execve_www
        Change the number "33" to the ID of your WebServer user. Default: www-data:x:33:33
detection:
    selection:
        type: 'SYSCALL'
        SYSCALL:
            - 'execve'
            - 'execveat'
        euid: 33
    condition: selection
falsepositives:
    - Admin activity
    - Crazy web applications
level: critical

Original YAML and metadata in JSON

False positives

• Admin activity
• Crazy web applications

Source references

• Personal Experience of the Author (source note; no public URL supplied)
• https://www.vaadata.com/blog/what-is-command-injection-exploitations-and-security-best-practices/