detection.wiki

Detection rules › Kusto

Corelight - Possible Webshell (Rare PUT or POST)

Status
available
Severity
medium
Time window
1h
Group by
id_orig_h, uri
Source
github.com/Azure/Azure-Sentinel

'Detects rare post requests to a single webserver location.'

MITRE ATT&CK coverage

TacticTechniques
Persistence

Rule body

id: db662e49-6e34-4d10-9d3c-5d04b5479658
name: Corelight - Possible Webshell (Rare PUT or POST)
description: |
  'Detects rare post requests to a single webserver location.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: Corelight
    dataTypes:
      - Corelight_v2_http
      - corelight_http
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Persistence
relevantTechniques:
  - T1505
query: |
  let threshold = 3;
  corelight_http
  | where method in~ ('POST', 'PUT')
  | where toint(status_code) !between (400 .. 499)
  | where request_body_len != 0 or response_body_len != 0
  | extend fe = extract(@'.*(\.\w+)$', 1, uri)
  | where fe in~ ('.aspx', '.asp', '.php', '.jsp', '.jspx', '.war', '.ashx', '.asmx', '.ascx', '.asx', '.cshtml', '.cfm', '.cfc', '.cfml', '.wss', '.do', '.action', '.pl', '.plx', '.pm', '.xs', '.t', '.pod', '.php-s', '.pht', '.phar', '.phps', '.php7', '.php5', '.php4', '.php3', '.phtml', '.py', '.rb', '.rhtml', '.cgi', '.dll', '.ayws', '.cgi', '.erb', '.rjs', '.hta', '.htc', '.cs', '.kt', '.lua', '.vbhtml')
  | summarize count() by uri, id_orig_h
  | where count_ < threshold
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: id_orig_h
version: 2.1.0
kind: Scheduled

Stages and Predicates

Parameters

let threshold = 3;

Stage 1: source

corelight_http

Stage 2: where

| where method in~ ('POST', 'PUT')

Stage 3: where

| where toint(status_code) !between (400 .. 499)

Stage 4: where

| where request_body_len != 0 or response_body_len != 0

Stage 5: extend

| extend fe = extract(@'.*(\.\w+)$', 1, uri)

Stage 6: where

| where fe in~ ('.aspx', '.asp', '.php', '.jsp', '.jspx', '.war', '.ashx', '.asmx', '.ascx', '.asx', '.cshtml', '.cfm', '.cfc', '.cfml', '.wss', '.do', '.action', '.pl', '.plx', '.pm', '.xs', '.t', '.pod', '.php-s', '.pht', '.phar', '.phps', '.php7', '.php5', '.php4', '.php3', '.phtml', '.py', '.rb', '.rhtml', '.cgi', '.dll', '.ayws', '.cgi', '.erb', '.rjs', '.hta', '.htc', '.cs', '.kt', '.lua', '.vbhtml')

Stage 7: summarize

| summarize count() by uri, id_orig_h

Stage 8: where

| where count_ < threshold

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
count_lt
  • 3
field:"count_" kind:lt value:"3"
fein
  • .action
  • .ascx
  • .ashx
  • .asmx
  • .asp
  • .aspx
  • .asx
  • .ayws
  • .cfc
  • .cfm
  • .cfml
  • .cgi
  • .cs
  • .cshtml
  • .dll
  • .do
  • .erb
  • .hta
  • .htc
  • .jsp
  • .jspx
  • .kt
  • .lua
  • .phar
  • .php
  • .php-s
  • .php3
  • .php4
  • .php5
  • .php7
  • .phps
  • .pht
  • .phtml
  • .pl
  • .plx
  • .pm
  • .pod
  • .py
  • .rb
  • .rhtml
  • .rjs
  • .t
  • .vbhtml
  • .war
  • .wss
  • .xs
field:"fe" kind:in
methodin
  • POST
  • PUT
field:"method" kind:in
request_body_lenne
  • 0
field:"request_body_len" kind:ne value:"0"
response_body_lenne
  • 0
field:"response_body_len" kind:ne value:"0"

Output fields

These fields are emitted when the rule matches.

FieldSource
id_orig_hsummarize
urisummarize