Detection rules › Sigma
DEWMODE Webshell Access
Detects access to DEWMODE webshell as described in FIREEYE report
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence |
Rule body
title: DEWMODE Webshell Access
id: fdf96c90-42d5-4406-8a9c-14a2c9a016b5
status: test
description: Detects access to DEWMODE webshell as described in FIREEYE report
references:
- https://www.mandiant.com/resources/blog/accellion-fta-exploited-for-data-theft-and-extortion
author: Florian Roth (Nextron Systems)
date: 2021-02-22
modified: 2023-01-02
tags:
- attack.persistence
- attack.t1505.003
- detection.emerging-threats
logsource:
category: webserver
detection:
selection1:
cs-uri-query|contains|all:
- '?dwn='
- '&fn='
- '.html?'
selection2:
cs-uri-query|contains|all:
- '&dwn='
- '?fn='
- '.html?'
condition: 1 of selection*
falsepositives:
- Unknown
level: high
Stages and Predicates
Stage 0: condition
1 of selection*Stage 1: selection1
selection1:
cs-uri-query|contains|all:
- '?dwn='
- '&fn='
- '.html?'
Stage 2: selection2
selection2:
cs-uri-query|contains|all:
- '&dwn='
- '?fn='
- '.html?'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
cs-uri-query | match |
| field:"cs-uri-query" kind:match |