Webshell Tool Reconnaissance Activity — Sigma Rule

Rule metadata and linked tags

Author: Cian Heasley, Florian Roth (Nextron Systems). Source status: test; severity: high. Source dates: 2020-07-22 / 2023-11-09.

{
  "category": "process_creation",
  "product": "windows"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: ebb6955781783f6394bc7887940068b68f8f028996ee97ba426137152afa50c1

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Webshell Tool Reconnaissance Activity
id: f64e5c19-879c-4bae-b471-6d84c8339677
status: test
description: |
    Detects processes spawned from web servers (PHP, Tomcat, IIS, etc.) that perform reconnaissance looking for the existence of popular scripting tools (perl, python, wget) on the system via the help commands
references:
    - https://ragged-lab.blogspot.com/2020/07/webshells-automating-reconnaissance.html
author: Cian Heasley, Florian Roth (Nextron Systems)
date: 2020-07-22
modified: 2023-11-09
tags:
    - attack.persistence
    - attack.t1505.003
logsource:
    category: process_creation
    product: windows
detection:
    selection_webserver_image:
        ParentImage|endswith:
            - '\caddy.exe'
            - '\httpd.exe'
            - '\nginx.exe'
            - '\php-cgi.exe'
            - '\w3wp.exe'
            - '\ws_tomcatservice.exe'
    selection_webserver_characteristics_tomcat1:
        ParentImage|endswith:
            - '\java.exe'
            - '\javaw.exe'
        ParentImage|contains:
            - '-tomcat-'
            - '\tomcat'
    selection_webserver_characteristics_tomcat2:
        ParentImage|endswith:
            - '\java.exe'
            - '\javaw.exe'
        CommandLine|contains:
            - 'CATALINA_HOME'
            - 'catalina.jar'
    selection_recon:
        CommandLine|contains:
            - 'perl --help'
            - 'perl -h'
            - 'python --help'
            - 'python -h'
            - 'python3 --help'
            - 'python3 -h'
            - 'wget --help'
    condition: 1 of selection_webserver_* and selection_recon
falsepositives:
    - Unknown
level: high

Original YAML and metadata in JSON

False positives

• Unknown

Source references

• https://ragged-lab.blogspot.com/2020/07/webshells-automating-reconnaissance.html