Antivirus - Web Shell Detection Signature

Status: test
Severity: high
Log source: category antivirus
Author: Florian Roth (Nextron Systems), Arnim Rupp
Source: github.com/SigmaHQ/sigma

Detects a highly relevant Antivirus alert that reports a web shell. It's highly recommended to tune this rule to the specific strings used by your anti virus solution by downloading a big WebShell repository from e.g. github and checking the matches. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Known false positives

Unlikely

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1505.003` Server Software Component: Web Shell

Rule body

title: Antivirus - Web Shell Detection Signature
id: fdf135a2-9241-4f96-a114-bb404948f736
status: test
description: |
    Detects a highly relevant Antivirus alert that reports a web shell.
    It's highly recommended to tune this rule to the specific strings used by your anti virus solution by downloading a big WebShell repository from e.g. github and checking the matches.
    This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
references:
    - https://www.nextron-systems.com/?s=antivirus
    - https://github.com/tennc/webshell
    - https://www.virustotal.com/gui/file/bd1d52289203866645e556e2766a21d2275877fbafa056a76fe0cf884b7f8819/detection
    - https://www.virustotal.com/gui/file/308487ed28a3d9abc1fec7ebc812d4b5c07ab025037535421f64c60d3887a3e8/detection
    - https://www.virustotal.com/gui/file/7d3cb8a8ff28f82b07f382789247329ad2d7782a72dde9867941f13266310c80/detection
    - https://www.virustotal.com/gui/file/e841675a4b82250c75273ebf0861245f80c6a1c3d5803c2d995d9d3b18d5c4b5/detection
    - https://www.virustotal.com/gui/file/a80042c61a0372eaa0c2c1e831adf0d13ef09feaf71d1d20b216156269045801/detection
    - https://www.virustotal.com/gui/file/b219f7d3c26f8bad7e175934cd5eda4ddb5e3983503e94ff07d39c0666821b7e/detection
    - https://www.virustotal.com/gui/file/b8702acf32fd651af9f809ed42d15135f842788cd98d81a8e1b154ee2a2b76a2/detection
    - https://www.virustotal.com/gui/file/13ae8bfbc02254b389ab052aba5e1ba169b16a399d9bc4cb7414c4a73cd7dc78/detection
author: Florian Roth (Nextron Systems), Arnim Rupp
date: 2018-09-09
modified: 2026-06-29
tags:
    - attack.persistence
    - attack.t1505.003
logsource:
    category: antivirus
detection:
    selection:
        - Signature|startswith:
              - 'ASP.'
              - 'IIS/BackDoor'
              - 'JAVA/Backdoor'
              - 'JSP.'
              - 'Perl.'
              - 'PHP.'
              - 'Troj/ASP'
              - 'Troj/JSP'
              - 'Troj/PHP'
              - 'VBS/Uxor' # looking for 'VBS/' would also find downloader's and droppers meant for desktops
        - Signature|contains:
              - 'ASP_' # looking for 'VBS_' would also find downloader's and droppers meant for desktops
              - 'ASP:'
              - 'ASP.Agent'
              - 'ASP/'
              # - 'ASP/Agent'
              - 'Aspdoor'
              - 'ASPXSpy'
              - 'Backdoor.ASP'
              - 'Backdoor.Java'
              - 'Backdoor.JSP'
              - 'Backdoor.PHP'
              - 'Backdoor.VBS'
              - 'Backdoor/ASP'
              - 'Backdoor/Java'
              - 'Backdoor/JSP'
              - 'Backdoor/PHP'
              - 'Backdoor/VBS'
              - 'C99shell'
              - 'Chopper'
              - 'filebrowser'
              - 'JSP_'
              - 'JSP:'
              - 'JSP.Agent'
              - 'JSP/'
              # - 'JSP/Agent'
              - 'Perl:'
              - 'Perl/'
              - 'PHP_'
              - 'PHP:'
              - 'PHP.Agent'
              - 'PHP/'
              # - 'PHP/Agent'
              - 'PHPShell'
              - 'PShlSpy'
              - 'SinoChoper'
              - 'Trojan.ASP'
              - 'Trojan.JSP'
              - 'Trojan.PHP'
              - 'Trojan.VBS'
              - 'VBS.Agent'
              - 'VBS/Agent'
              - 'Webshell'
    condition: selection
falsepositives:
    - Unlikely
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    - Signature|startswith:
          - 'ASP.'
          - 'IIS/BackDoor'
          - 'JAVA/Backdoor'
          - 'JSP.'
          - 'Perl.'
          - 'PHP.'
          - 'Troj/ASP'
          - 'Troj/JSP'
          - 'Troj/PHP'
          - 'VBS/Uxor'
    - Signature|contains:
          - 'ASP_'
          - 'ASP:'
          - 'ASP.Agent'
          - 'ASP/'
          - 'Aspdoor'
          - 'ASPXSpy'
          - 'Backdoor.ASP'
          - 'Backdoor.Java'
          - 'Backdoor.JSP'
          - 'Backdoor.PHP'
          - 'Backdoor.VBS'
          - 'Backdoor/ASP'
          - 'Backdoor/Java'
          - 'Backdoor/JSP'
          - 'Backdoor/PHP'
          - 'Backdoor/VBS'
          - 'C99shell'
          - 'Chopper'
          - 'filebrowser'
          - 'JSP_'
          - 'JSP:'
          - 'JSP.Agent'
          - 'JSP/'
          - 'Perl:'
          - 'Perl/'
          - 'PHP_'
          - 'PHP:'
          - 'PHP.Agent'
          - 'PHP/'
          - 'PHPShell'
          - 'PShlSpy'
          - 'SinoChoper'
          - 'Trojan.ASP'
          - 'Trojan.JSP'
          - 'Trojan.PHP'
          - 'Trojan.VBS'
          - 'VBS.Agent'
          - 'VBS/Agent'
          - 'Webshell'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Signature`	match	`ASP.Agent` `ASP/` `ASP:` `ASPXSpy` `ASP_` `Aspdoor` `Backdoor.ASP` `Backdoor.JSP` `Backdoor.Java` `Backdoor.PHP` `Backdoor.VBS` `Backdoor/ASP` `Backdoor/JSP` `Backdoor/Java` `Backdoor/PHP` `Backdoor/VBS` `C99shell` `Chopper` `JSP.Agent` `JSP/` `JSP:` `JSP_` `PHP.Agent` `PHP/` `PHP:` `PHPShell` `PHP_` `PShlSpy` `Perl/` `Perl:` `SinoChoper` `Trojan.ASP` `Trojan.JSP` `Trojan.PHP` `Trojan.VBS` `VBS.Agent` `VBS/Agent` `Webshell` `filebrowser`	`field:"Signature" kind:match`
`Signature`	starts_with	`ASP.` `IIS/BackDoor` `JAVA/Backdoor` `JSP.` `PHP.` `Perl.` `Troj/ASP` `Troj/JSP` `Troj/PHP` `VBS/Uxor`	`field:"Signature" kind:starts_with`