Webshell Tool Reconnaissance Activity

Status: test
Severity: high
Log source: category process_creation, product windows
Author: Cian Heasley, Florian Roth (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects processes spawned from web servers (PHP, Tomcat, IIS, etc.) that perform reconnaissance looking for the existence of popular scripting tools (perl, python, wget) on the system via the help commands

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1505.003` Server Software Component: Web Shell

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: Webshell Tool Reconnaissance Activity
id: f64e5c19-879c-4bae-b471-6d84c8339677
status: test
description: |
    Detects processes spawned from web servers (PHP, Tomcat, IIS, etc.) that perform reconnaissance looking for the existence of popular scripting tools (perl, python, wget) on the system via the help commands
references:
    - https://ragged-lab.blogspot.com/2020/07/webshells-automating-reconnaissance.html
author: Cian Heasley, Florian Roth (Nextron Systems)
date: 2020-07-22
modified: 2023-11-09
tags:
    - attack.persistence
    - attack.t1505.003
logsource:
    category: process_creation
    product: windows
detection:
    selection_webserver_image:
        ParentImage|endswith:
            - '\caddy.exe'
            - '\httpd.exe'
            - '\nginx.exe'
            - '\php-cgi.exe'
            - '\w3wp.exe'
            - '\ws_tomcatservice.exe'
    selection_webserver_characteristics_tomcat1:
        ParentImage|endswith:
            - '\java.exe'
            - '\javaw.exe'
        ParentImage|contains:
            - '-tomcat-'
            - '\tomcat'
    selection_webserver_characteristics_tomcat2:
        ParentImage|endswith:
            - '\java.exe'
            - '\javaw.exe'
        CommandLine|contains:
            - 'CATALINA_HOME'
            - 'catalina.jar'
    selection_recon:
        CommandLine|contains:
            - 'perl --help'
            - 'perl -h'
            - 'python --help'
            - 'python -h'
            - 'python3 --help'
            - 'python3 -h'
            - 'wget --help'
    condition: 1 of selection_webserver_* and selection_recon
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

1 of selection_webserver_* and selection_recon

Stage 1: `selection_webserver_image`

selection_webserver_image:
    ParentImage|endswith:
        - '\caddy.exe'
        - '\httpd.exe'
        - '\nginx.exe'
        - '\php-cgi.exe'
        - '\w3wp.exe'
        - '\ws_tomcatservice.exe'

Stage 2: `selection_webserver_characteristics_tomcat1`

selection_webserver_characteristics_tomcat1:
    ParentImage|endswith:
        - '\java.exe'
        - '\javaw.exe'
    ParentImage|contains:
        - '-tomcat-'
        - '\tomcat'

Stage 3: `selection_webserver_characteristics_tomcat2`

selection_webserver_characteristics_tomcat2:
    ParentImage|endswith:
        - '\java.exe'
        - '\javaw.exe'
    CommandLine|contains:
        - 'CATALINA_HOME'
        - 'catalina.jar'

Stage 4: `selection_recon`

selection_recon:
    CommandLine|contains:
        - 'perl --help'
        - 'perl -h'
        - 'python --help'
        - 'python -h'
        - 'python3 --help'
        - 'python3 -h'
        - 'wget --help'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`CATALINA_HOME` corpus 3 (sigma 3) `catalina.jar` corpus 3 (sigma 3) `perl --help` `perl -h` `python --help` `python -h` `python3 --help` `python3 -h` `wget --help`	`field:"CommandLine" kind:match`
`ParentImage`	ends_with	`\caddy.exe` corpus 4 (sigma 4) `\httpd.exe` corpus 6 (sigma 6) `\java.exe` corpus 8 (sigma 8) `\javaw.exe` corpus 7 (sigma 7) `\nginx.exe` corpus 6 (sigma 6) `\php-cgi.exe` corpus 6 (sigma 6) `\w3wp.exe` corpus 12 (sigma 12) `\ws_tomcatservice.exe` corpus 6 (sigma 6)	`field:"ParentImage" kind:ends_with`
`ParentImage`	match	`-tomcat-` corpus 4 (sigma 4) `\tomcat` corpus 6 (sigma 6)	`field:"ParentImage" kind:match`

Webshell Tool Reconnaissance Activity

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_webserver_image

Stage 2: selection_webserver_characteristics_tomcat1