detection.wiki

Detection rules › Sigma

Windows Webshell Strings

Status
test
Severity
high
Log source
category webserver
Author
Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects common commands used in Windows webshells

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1505.003 Server Software Component: Web Shell

Rule body yaml

title: Windows Webshell Strings
id: 7ff9db12-1b94-4a79-ba68-a2402c5d6729
status: test
description: Detects common commands used in Windows webshells
references:
    - https://bad-jubies.github.io/RCE-NOW-WHAT/
    - https://m365internals.com/2022/10/07/hunting-in-on-premises-exchange-server-logs/
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
date: 2017-02-19
modified: 2022-11-18
tags:
    - attack.persistence
    - attack.t1505.003
logsource:
    category: webserver
detection:
    selection_method:
        cs-method: 'GET'
    selection_keywords:
        # The "%20" is URL encoded version of the space
        # The "%2B" is URL encoded version of the "+"
        - '=whoami'
        - '=net%20user'
        - '=net+user'
        - '=net%2Buser'
        - '=cmd%20/c%'
        - '=cmd+/c+'
        - '=cmd%2B/c%'
        - '=cmd%20/r%'
        - '=cmd+/r+'
        - '=cmd%2B/r%'
        - '=cmd%20/k%'
        - '=cmd+/k+'
        - '=cmd%2B/k%'
        - '=powershell%'
        - '=powershell+'
        - '=tasklist%'
        - '=tasklist+'
        - '=wmic%'
        - '=wmic+'
        - '=ssh%'
        - '=ssh+'
        - '=python%'
        - '=python+'
        - '=python3%'
        - '=python3+'
        - '=ipconfig'
        - '=wget%'
        - '=wget+'
        - '=curl%'
        - '=curl+'
        - '=certutil'
        - '=copy%20%5C%5C'
        - '=dsquery%'
        - '=dsquery+'
        - '=nltest%'
        - '=nltest+'
    condition: all of selection_*
falsepositives:
    - Web sites like wikis with articles on os commands and pages that include the os commands in the URLs
    - User searches in search boxes of the respective website
level: high

Stages and Predicates

Stage 0: condition

all of selection_*

Stage 1: selection_method

selection_method:
    cs-method: 'GET'

Stage 2: selection_keywords

selection_keywords:
    - '=whoami'
    - '=net%20user'
    - '=net+user'
    - '=net%2Buser'
    - '=cmd%20/c%'
    - '=cmd+/c+'
    - '=cmd%2B/c%'
    - '=cmd%20/r%'
    - '=cmd+/r+'
    - '=cmd%2B/r%'
    - '=cmd%20/k%'
    - '=cmd+/k+'
    - '=cmd%2B/k%'
    - '=powershell%'
    - '=powershell+'
    - '=tasklist%'
    - '=tasklist+'
    - '=wmic%'
    - '=wmic+'
    - '=ssh%'
    - '=ssh+'
    - '=python%'
    - '=python+'
    - '=python3%'
    - '=python3+'
    - '=ipconfig'
    - '=wget%'
    - '=wget+'
    - '=curl%'
    - '=curl+'
    - '=certutil'
    - '=copy%20%5C%5C'
    - '=dsquery%'
    - '=dsquery+'
    - '=nltest%'
    - '=nltest+'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
cs-methodeq
  • GET