Web Server Exploitation Detected via Defend for Containers

  1[metadata]
  2creation_date = "2026/02/06"
  3integration = ["cloud_defend"]
  4maturity = "production"
  5min_stack_comments = "Defend for Containers integration was re-introduced in 9.3.0"
  6min_stack_version = "9.3.0"
  7updated_date = "2026/09/18"
  8
  9[rule]
 10author = ["Elastic"]
 11description = """
 12This rule detects the exploitation of a web server through the execution of a suspicious process by common web server
 13user accounts. Attackers may upload a web shell to a web server to maintain access to the system.
 14"""
 15from = "now-6m"
 16index = ["logs-cloud_defend.process*"]
 17interval = "5m"
 18language = "eql"
 19license = "Elastic License v2"
 20name = "Web Server Exploitation Detected via Defend for Containers"
 21note = """## Triage and analysis
 22
 23> **Disclaimer**:
 24> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 25
 26### Investigating Web Server Exploitation Detected via Defend for Containers
 27
 28This rule flags Linux container activity where a web server (or typical web-service account) executes a suspicious process, a strong indicator of web app exploitation rather than normal request handling. It matters because this pattern commonly marks initial foothold and post-exploitation execution that can lead to persistence and lateral movement from the service container. A typical attacker flow drops a web shell or abuses RCE to launch `sh -c` and pull or run a secondary payload (e.g., reverse shell).
 29
 30### Possible investigation steps
 31
 32- Capture the full executed command line and decode/normalize any obfuscation (base64, hex, URL encoding) to determine the operator intent and any payload retrieval or reverse-shell behavior.  
 33- Correlate the execution timestamp with web access/error logs and ingress/WAF events to identify the triggering request path, parameters, and source IP/user-agent indicating RCE or web-shell invocation.  
 34- Inspect recent file and permission changes in the container’s application and web directories (including temp and upload paths) to identify newly dropped scripts/binaries, cron entries, or modified server configs.  
 35- Review container and orchestration context (image tag/digest, recent deploys, exec sessions, and Kubernetes events) to determine whether the activity aligns with a legitimate rollout or represents in-container compromise.  
 36- Check network telemetry for the container around the event for suspicious outbound connections, DNS lookups, or downloads, then pivot to any contacted hosts to assess command-and-control or staging infrastructure.
 37
 38### False positive analysis
 39
 40- A web application or server-side script running under the web-service account legitimately invokes `sh -c` (e.g., to run maintenance tasks like log rotation, cache rebuilds, file conversions, or templating/asset compilation) from a web directory such as `/var/www/*`, causing the web server to spawn a shell child process.  
 41- During container startup or a deployment/health-check routine, the web server process launches a shell via `sh -c` to perform initialization (e.g., environment substitution, dynamic configuration generation, permission fixes, or calling bundled helper scripts), which can resemble exploitation when the parent is a web server and the child is a shell.
 42
 43### Response and remediation
 44
 45- Immediately isolate the affected container/pod from inbound and outbound traffic (quarantine namespace/security group or apply a deny-all NetworkPolicy) and stop the workload to prevent further `sh -c` execution and potential C2.  
 46- Preserve evidence by exporting the container filesystem and logs (web access/error logs, application logs, and process output) and capture the exact shell command string and any downloaded payloads or newly created files in web roots, temp, and upload directories.  
 47- Eradicate by removing any identified web shells/backdoors and reverting unauthorized changes, then rebuild and redeploy the service from a known-good image digest while rotating secrets exposed to the container (service tokens, database creds, API keys).  
 48- Recover by validating application integrity and behavior post-redeploy (no unexpected shell spawns, no abnormal outbound connections, clean health checks) and monitor the previously contacted IPs/domains for further callbacks from other workloads.  
 49- Escalate to incident response and platform security immediately if the shell command indicates payload retrieval, reverse shell activity, credential access, or if similar `sh -c` executions are observed across multiple containers/namespaces.  
 50- Harden by removing shell binaries from runtime images where feasible, enforcing non-root and read-only filesystems, restricting egress to required destinations only, disabling risky interpreter execution paths in the web app, and adding WAF/RCE protections for the identified vulnerable endpoint."""
 51risk_score = 73
 52rule_id = "497a7091-0ebd-44d7-88c4-367ab4d4d852"
 53severity = "high"
 54tags = [
 55    "Data Source: Elastic Defend for Containers",
 56    "Domain: Containers",
 57    "OS: Linux",
 58    "Use Case: Threat Detection",
 59    "Tactic: Persistence",
 60    "Tactic: Execution",
 61    "Tactic: Command and Control",
 62    "Resources: Investigation Guide",
 63    "Noise: Unknown",
 64    "Performance: Fast",
 65    "Profile: Recommended",
 66    "Threat: Web Shell",
 67    "Threat: Vulnerability Exploit",
 68    "Rule Type: Event Correlation (EQL)",
 69    "Platform: Linux",
 70    "Platform: Kubernetes",
 71]
 72timestamp_override = "event.ingested"
 73type = "eql"
 74query = '''
 75process where event.type == "start" and event.action == "exec" and process.parent.interactive == false and
 76container.id like "?*" and (
 77  process.parent.name in (
 78    "nginx", "apache2", "httpd", "caddy", "mongrel_rails", "uwsgi", "daphne", "httpd.worker", "flask",
 79    "php-cgi", "php-fcgi", "php-cgi.cagefs", "lswsctrl", "varnishd", "uvicorn", "waitress-serve", "starman"
 80  ) or
 81  process.parent.name like ("php-fpm*", "gunicorn*", "*.cgi", "*.fcgi") or
 82  (process.parent.name like "ruby*" and process.parent.args like~ ("*puma*", "*rails*", "*passenger*")) or
 83  (process.parent.name like "python*" and process.parent.args like~ (
 84    "*hypercorn*", "*flask*", "*uvicorn*", "*django*", "*app.py*", "*server.py*", "*wsgi.py*", "*asgi.py*"
 85  )) or
 86  (process.parent.name like "perl*" and process.parent.args like~ "*plackup*") or
 87  (process.parent.name == "node" and process.parent.args like~ (
 88    "*next start*", "*--port*", "*PORT=*", "*HOST=*", "*0.0.0.0*", "*/dist/*.js*", "*/build/*.js*", "*/server/*.js*",
 89    "*/app/*.js*","*/apps/*/*.js*", "*/index.js*", "*/main.js*", "*/srv/*", "*/opt/*", "*/var/www/*"
 90    ) and
 91    not process.parent.args like ("/opt/cursor-agent/*", "/home/*/*", "/root/*", "/opt/vscode-server/*", "/usr/lib/node_modules/openclaw/dist/index.js") 
 92  ) or
 93  (process.parent.name == "java" and process.parent.args like~ (
 94    /* Tomcat */
 95    "org.apache.catalina.startup.Bootstrap", "-Dcatalina.base=*",
 96
 97    /* Jetty */
 98    "org.eclipse.jetty.start.Main", "-Djetty.home=*",
 99
100    /* WildFly / JBoss */
101    "org.jboss.modules.Main", "-Djboss.home.dir=*",
102
103    /* WebLogic */
104    "weblogic.Server", "-Dweblogic.Name=*", "*weblogic-launcher.jar*",
105
106    /* WebSphere traditional + Liberty */
107    "com.ibm.ws.runtime.WsServer", "com.ibm.ws.kernel.boot.cmdline.Bootstrap",
108
109    /* GlassFish */
110    "com.sun.enterprise.glassfish.bootstrap.ASMain",
111
112    /* Resin */
113    "com.caucho.server.resin.Resin",
114
115    /* Spring Boot */
116    "org.springframework.boot.loader.*",
117
118    /* Quarkus */
119    "*quarkus-run.jar*", "io.quarkus.runner.GeneratedMain",
120
121    /* Micronaut */
122    "io.micronaut.runtime.Micronaut",
123
124    /* Dropwizard */
125    "io.dropwizard.cli.ServerCommand",
126
127    /* Play */
128    "play.core.server.ProdServerStart",
129
130    /* Helidon */
131    "io.helidon.microprofile.server.Main", "io.helidon.webserver*",
132
133    /* Vert.x */
134    "io.vertx.core.Launcher",
135
136    /* Keycloak */
137    "org.keycloak*",
138
139    /* Apereo CAS */
140    "org.apereo.cas*",
141
142    /* Elasticsearch */
143    "org.elasticsearch.bootstrap.Elasticsearch",
144
145    /* Atlassian / Gerrit */
146    "com.atlassian.jira.startup.Launcher", "*BitbucketServerLauncher*", "com.google.gerrit.pgm.Daemon",
147
148    /* Solr */
149    "*-Dsolr.solr.home=*",
150
151    /* Jenkins */
152    "*jenkins.war*"
153    )
154  )
155) and
156process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "mksh", "busybox") and
157process.args in ("-c", "-cl", "-lc") and (
158  process.args like (
159    /* Suspicious Paths */
160    "* /tmp/* ", "* /var/tmp/* ", "* /dev/shm/*", "* /var/www/*", "* /run/*", "* /var/run/*",
161
162    /* Interpreter Execution */
163    "*python* -c*", "*php* -r*", "*perl* -e*", "*ruby* -e*", "*lua* -e*", "*node * -e *",
164
165    /* Encoding / Decoding */
166    "*base64 -*d*", "*|*base64 *", "*xxd *", "*openssl*enc * -d *",
167
168    /* Reverse Shells */
169    "*netcat *", "* nc *", "*ncat *", "*/dev/tcp*", "*/dev/udp/*", " *socat *", "*openssl*s_client *", "*stty*raw*-echo*",
170
171    /* File Access */
172    "*>*/etc/cron*", "*/etc/ssh*", "*/home/*/.ssh/*", "*/root/.ssh*", "*~/.ssh/*", "*/etc/shadow*", "*/etc/passwd*", "*chpasswd*",
173      
174    /* AWS Credentials */
175    "*aws_access_key_id*", "*aws_secret_access_key*", "*aws_session_token*", "*accesskeyid*", "*secretaccesskey*",
176    "*access_key*", "*.aws/credentials*", "*/.aws/config*",
177    
178    /* Azure Credentials */
179    "*AZURE_CLIENT_ID*", "*AZURE_TENANT_ID*", "*AZURE_CLIENT_SECRET*", "*AZURE_FEDERATED_TOKEN_FILE*",
180    "*IDENTITY_ENDPOINT*", "*IDENTITY_HEADER*", "*MSI_ENDPOINT*", "*MSI_SECRET*", "*/.azure/*",
181    "*/run/secrets/azure/*",
182    
183    /* GCP Credentials */
184    "*/.config/gcloud/*", "*application_default_credentials.json*", "*type: service_account*",
185    "*client_email*", "*private_key_id*", "*private_key*", "*/run/secrets/google/*", "*GOOGLE_APPLICATION_CREDENTIALS*",
186    
187    /* Misc. Cloud */
188    "*/.docker/config.json*", "*/.npmrc*", "*/secrets/kubernetes.io/serviceaccount/*",
189
190    /* Helpers */
191    "*nohup*", "*setsid *", "*timeout *sh -c *", "*disown*", "*env *sh *-c*",
192
193    /* Miscellaneous */
194    "*echo *", "*chattr *", "*busybox *",  "*#!*", "*chmod +x *", "*chmod 777*", 
195    
196    /* Decompression */
197    "*gzip -*d *", "*bzip2 -*d *", "*xz -*d *", "*tar -*x*",
198     
199     /* Path Traversal */
200     "*../../../*etc/*", "*/.../*", "*../../../*home/*/*", "*../../../*root/*",
201
202     "*|*sh", "*|*python*", "*|*php*", "*|*perl*", "*|*ruby*", "*|*node*", "*|*lua*", "*|*busybox*"
203  ) or
204  (
205    process.args like ("*wget *", "*curl *") and (
206      (
207        process.args like~ ("* -o *", "* --output*", "* -o- *") and
208        process.args regex ".*[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}.*"
209      ) or
210      (
211        process.args like ("*http://*", "*https://*") and
212        process.args like (
213          "* /tmp/*", "* /var/tmp/*", "* /dev/shm/* ", "* /var/www/*", "* ~/*",
214          "* /home/*", "* /run/*", "* /var/run/*"
215        )
216      )
217    )
218  )
219) and
220not (
221  (process.parent.name == "nginx" and process.args like ("chmod 777 /etc/resty-*", "resty*")) or
222  (process.parent.name == "apache2" and (
223    process.args in (
224      "/usr/local/bin/php -r 'echo phpversion();'",
225      "/usr/local/bin/php -r 'echo phpversion();'",
226      "/usr/bin/php -r 'echo phpversion();'"
227    ) or
228    process.args like """bash -c "( /home/*/apps/richdocumentscode/collabora/Collabora_Online.AppImage*"""
229    )
230  ) or
231  (process.parent.name like "php-fpm*" and process.args in (
232    "/usr/bin/php -r 'echo phpversion();'",
233    "/usr/bin/php -r 'echo phpversion();'",
234    "php -r 'print_r(phpversion());'",
235    "chattr -i -a /usr/local/virtualizor/license2.php"
236    )
237  ) or
238  (process.parent.name == "php-cgi" and process.args like (
239    "nohup php /home/*/public_html/lockindex.php index.php >/dev/null 2>&1 &",
240    "nohup php /home/*/public_html/wp-content/* >> /dev/null 2>&1 &",
241    "nohup php /home/*/public_html/wp-includes/* >> /dev/null 2>&1 &",
242    "nohup php /home/*/public_html/*/wp-content/* >> /dev/null 2>&1 &"
243    )
244  )
245)
246'''
247
248[[rule.threat]]
249framework = "MITRE ATT&CK"
250
251[[rule.threat.technique]]
252id = "T1505"
253name = "Server Software Component"
254reference = "https://attack.mitre.org/techniques/T1505/"
255
256[[rule.threat.technique.subtechnique]]
257id = "T1505.003"
258name = "Web Shell"
259reference = "https://attack.mitre.org/techniques/T1505/003/"
260
261[rule.threat.tactic]
262id = "TA0003"
263name = "Persistence"
264reference = "https://attack.mitre.org/tactics/TA0003/"
265
266[[rule.threat]]
267framework = "MITRE ATT&CK"
268
269[[rule.threat.technique]]
270id = "T1059"
271name = "Command and Scripting Interpreter"
272reference = "https://attack.mitre.org/techniques/T1059/"
273
274[[rule.threat.technique.subtechnique]]
275id = "T1059.004"
276name = "Unix Shell"
277reference = "https://attack.mitre.org/techniques/T1059/004/"
278
279[rule.threat.tactic]
280id = "TA0002"
281name = "Execution"
282reference = "https://attack.mitre.org/tactics/TA0002/"
283
284[[rule.threat]]
285framework = "MITRE ATT&CK"
286
287[[rule.threat.technique]]
288id = "T1071"
289name = "Application Layer Protocol"
290reference = "https://attack.mitre.org/techniques/T1071/"
291
292[[rule.threat.technique]]
293id = "T1095"
294name = "Non-Application Layer Protocol"
295reference = "https://attack.mitre.org/techniques/T1095/"
296
297[[rule.threat.technique]]
298id = "T1105"
299name = "Ingress Tool Transfer"
300reference = "https://attack.mitre.org/techniques/T1105/"
301
302[rule.threat.tactic]
303id = "TA0011"
304name = "Command and Control"
305reference = "https://attack.mitre.org/tactics/TA0011/"
306
307[[rule.threat]]
308framework = "MITRE ATT&CK"
309
310[[rule.threat.technique]]
311id = "T1552"
312name = "Unsecured Credentials"
313reference = "https://attack.mitre.org/techniques/T1552/"
314
315[[rule.threat.technique.subtechnique]]
316id = "T1552.001"
317name = "Credentials In Files"
318reference = "https://attack.mitre.org/techniques/T1552/001/"
319
320[rule.threat.tactic]
321id = "TA0006"
322name = "Credential Access"
323reference = "https://attack.mitre.org/tactics/TA0006/"
324
325[[rule.threat]]
326framework = "MITRE ATT&CK"
327
328[[rule.threat.technique]]
329id = "T1190"
330name = "Exploit Public-Facing Application"
331reference = "https://attack.mitre.org/techniques/T1190/"
332
333[rule.threat.tactic]
334id = "TA0001"
335name = "Initial Access"
336reference = "https://attack.mitre.org/tactics/TA0001/"