detection.wiki

Detection rules › Sigma

DEWMODE Webshell Access

Status
test
Severity
high
Log source
category webserver
Author
Florian Roth (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects access to DEWMODE webshell as described in FIREEYE report

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1505.003 Server Software Component: Web Shell

Rule body yaml

title: DEWMODE Webshell Access
id: fdf96c90-42d5-4406-8a9c-14a2c9a016b5
status: test
description: Detects access to DEWMODE webshell as described in FIREEYE report
references:
    - https://www.mandiant.com/resources/blog/accellion-fta-exploited-for-data-theft-and-extortion
author: Florian Roth (Nextron Systems)
date: 2021-02-22
modified: 2023-01-02
tags:
    - attack.persistence
    - attack.t1505.003
    - detection.emerging-threats
logsource:
    category: webserver
detection:
    selection1:
        cs-uri-query|contains|all:
            - '?dwn='
            - '&fn='
            - '.html?'
    selection2:
        cs-uri-query|contains|all:
            - '&dwn='
            - '?fn='
            - '.html?'
    condition: 1 of selection*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: condition

1 of selection*

Stage 1: selection1

selection1:
    cs-uri-query|contains|all:
        - '?dwn='
        - '&fn='
        - '.html?'

Stage 2: selection2

selection2:
    cs-uri-query|contains|all:
        - '&dwn='
        - '?fn='
        - '.html?'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
cs-uri-querymatch
  • &dwn=
  • &fn=
  • .html?
  • ?dwn=
  • ?fn=