Webshell ReGeorg Detection Via Web Logs

Status: test
Severity: high
Log source: category webserver
Author: Cian Heasley
Source: github.com/SigmaHQ/sigma

Certain strings in the uri_query field when combined with null referer and null user agent can indicate activity associated with the webshell ReGeorg.

Known false positives

Web applications that use the same URL parameters as ReGeorg

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1505.003` Server Software Component: Web Shell

Rule body

title: Webshell ReGeorg Detection Via Web Logs
id: 2ea44a60-cfda-11ea-87d0-0242ac130003
status: test
description: Certain strings in the uri_query field when combined with null referer and null user agent can indicate activity associated with the webshell ReGeorg.
references:
    - https://community.rsa.com/community/products/netwitness/blog/2019/02/19/web-shells-and-netwitness-part-3
    - https://github.com/sensepost/reGeorg
author: Cian Heasley
date: 2020-08-04
modified: 2023-01-02
tags:
    - attack.persistence
    - attack.t1505.003
logsource:
    category: webserver
detection:
    selection:
        cs-uri-query|contains:
            - 'cmd=read'
            - 'connect&target'
            - 'cmd=connect'
            - 'cmd=disconnect'
            - 'cmd=forward'
    filter:
        cs-referer: null
        cs-user-agent: null
        cs-method: POST
    condition: selection and filter
falsepositives:
    - Web applications that use the same URL parameters as ReGeorg
level: high

Stages and Predicates

Stage 0: `condition`

selection and filter

Stage 1: `selection`

selection:
    cs-uri-query|contains:
        - 'cmd=read'
        - 'connect&target'
        - 'cmd=connect'
        - 'cmd=disconnect'
        - 'cmd=forward'

Stage 2: `filter`

filter:
    cs-referer: null
    cs-user-agent: null
    cs-method: POST

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`cs-method`	eq	`POST`	`field:"cs-method" kind:eq value:"POST"`
`cs-referer`	is_null	(no value, null check)	`field:"cs-referer" kind:is_null`
`cs-uri-query`	match	`cmd=connect` `cmd=disconnect` `cmd=forward` `cmd=read` `connect&target`	`field:"cs-uri-query" kind:match`
`cs-user-agent`	is_null	(no value, null check)	`field:"cs-user-agent" kind:is_null`