File with High Entropy Created by Web Server

  1[metadata]
  2creation_date = "2026/09/07"
  3integration = ["endpoint"]
  4maturity = "production"
  5min_stack_version = "9.3.0"
  6min_stack_comments = "The file.Ext.* fields for file events were introduced in 9.3.0, and are required for this rule to function."
  7updated_date = "2026/09/07"
  8
  9[rule]
 10author = ["Elastic"]
 11description = """
 12This rule detects when a web server process creates a file with high entropy, where the file
 13extension is a web extension. This is a common indicator of an encrypted or encoded payload
 14being uploaded.
 15"""
 16from = "now-9m"
 17index = ["logs-endpoint.events.file*"]
 18language = "eql"
 19license = "Elastic License v2"
 20name = "File with High Entropy Created by Web Server"
 21note = """## Triage and analysis
 22
 23> **Disclaimer**:
 24> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 25
 26### Investigating File with High Entropy Created by Web Server
 27
 28This detection identifies a Linux web server process writing a high-entropy file with a web-executable extension, which can signal an encoded or encrypted payload planted through an exposed application. After exploiting a vulnerable upload endpoint, an attacker may save an obfuscated PHP web shell as a .phtml file under the document root, then invoke it over HTTP to establish persistent remote access.
 29
 30### Possible investigation steps
 31
 32- Determine the file’s full path, owner, permissions, timestamps, hash, and proximity to document roots, upload directories, temporary locations, or recent authorized deployments.
 33- Preserve a copy and inspect its true file type, strings, structure, obfuscation, embedded payloads, and known-malware reputation in a controlled environment without executing it.
 34- Correlate the creation time with process ancestry, command lines, service account activity, child processes, and network connections to identify the originating request or exploited application component.
 35- Review reverse-proxy, web access, WAF, and application logs for upload attempts, exploit patterns, source addresses, authentication context, and subsequent requests to the created file.
 36- Hunt for the same hash, filename, path, source address, or related execution across hosts, and isolate the server while removing the artifact and remediating the vulnerable entry point if malicious activity is confirmed.
 37
 38### False positive analysis
 39
 40- An authorized application deployment may cause a web server process to write minified JavaScript or packaged application files with naturally high entropy; verify the creation time, path, hash, and deployment records against the approved release.
 41- A Python web application may legitimately generate high-entropy bytecode cache files with a .pyc extension during startup or module import; confirm the files reside in expected cache directories and correlate with a sanctioned restart or code update.
 42
 43### Response and remediation
 44
 45- Isolate the affected web server from untrusted networks while preserving the high-entropy file, web logs, process artifacts, and memory for incident-response analysis.
 46- Quarantine the malicious file and remove related web shells, unauthorized accounts, scheduled tasks, service changes, startup scripts, SSH keys, and altered application components identified across the environment.
 47- Rebuild the server from a known-good image, restore validated application content and configuration, patch the exploited component, and rotate web service, application, database, API, and administrative credentials.
 48- Open an incident-response case and escalate to major-incident handling immediately if the file was executed, attacker commands or outbound connections are found, privileged credentials were exposed, or related artifacts appear on other hosts.
 49- Block confirmed malicious hashes, source addresses, domains, and request patterns, then hunt for matching files, exploitation attempts, and post-compromise activity across web servers and dependent systems.
 50- Prevent recurrence by restricting upload locations from executing code, enforcing extension and content validation, applying least-privilege permissions to web service accounts, and strengthening WAF rules and file-integrity monitoring.
 51"""
 52risk_score = 73
 53rule_id = "f2738cad-28ab-4c9e-b7f0-66f3b2775e5f"
 54setup = """## Setup
 55
 56This rule requires data coming in from Elastic Defend.
 57
 58### Elastic Defend Integration Setup
 59Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
 60
 61#### Prerequisite Requirements:
 62- Fleet is required for Elastic Defend.
 63- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
 64
 65#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
 66- Go to the Kibana home page and click "Add integrations".
 67- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
 68- Click "Add Elastic Defend".
 69- Configure the integration name and optionally add a description.
 70- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
 71- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
 72- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
 73- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
 74For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
 75- Click "Save and Continue".
 76- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
 77For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
 78
 79Elastic Defend integration does not collect advanced file information (such as the different file.Ext.* fields) by default.
 80In order to capture this behavior, this rule requires a specific configuration option set within the advanced settings of the Elastic Defend integration.
 81 #### To set up advanced file information capture for an Elastic Agent policy:
 82- Go to “Security → Manage → Policies”.
 83- Select an “Elastic Agent policy”.
 84- Click “Show advanced settings”.
 85- Scroll down or search for “linux.advanced.events.populate_file_data”.
 86- For this rule the linux.advanced.events.populate_file_data variable should be set to "true".
 87- Click “Save”.
 88After saving the integration change, the Elastic Agents running this policy will be updated and the rule will function properly.
 89"""
 90severity = "high"
 91tags = [
 92    "Domain: Endpoint",
 93    "OS: Linux",
 94    "Use Case: Threat Detection",
 95    "Use Case: Vulnerability",
 96    "Tactic: Persistence",
 97    "Tactic: Initial Access",
 98    "Tactic: Lateral Movement",
 99    "Data Source: Elastic Defend",
100    "Rule Type: Event Correlation (EQL)",
101    "Resources: Investigation Guide"
102]
103timestamp_override = "event.ingested"
104type = "eql"
105query = '''
106file where host.os.type == "linux" and event.action != "deletion" and
107
108/* Entropy threshold chosen to flag likely encoded/encrypted payload uploads while limiting false positives. */
109file.Ext.entropy >= 6.0 and
110
111(
112  process.name in (
113    "nginx", "apache2", "httpd", "caddy", "lighttpd", "httpd.worker", "httpd-worker", "httpd-prefork",
114    "php-cgi", "php-fcgi", "php-cgi.cagefs", "frankenphp", "lshttpd", "litespeed", "openlitespeed",
115    "fcgiwrap", "uwsgi", "daphne", "uvicorn", "hypercorn", "granian", "waitress-serve", "flask", "puma",
116    "unicorn", "unicorn_rails", "thin", "rackup", "mongrel_rails", "starman", "plackup", "twiggy",
117    "hypnotoad", "starlet", "unitd", "unitd-debug"
118  ) or
119  process.name like ("php-fpm*", "lsphp*", "gunicorn*", "*.cgi", "*.fcgi")
120) and
121file.extension in~ (
122  "php", "phtml", "pht", "php3", "php4", "php5", "php7", "phar",
123  "asp", "aspx", "ashx", "asmx", "ascx", "cshtml", "razor",
124  "jsp", "jspx", "jsx", "jspf", "tag", "tagx", "war", "ear",
125  "js", "mjs", "cjs", "ts", "mts", "cts", "tsx",
126  "py", "wsgi", "cgi", "fcgi", "pyc",
127  "erb", "ru",
128  "psgi",
129  "lua", "luac",
130  "sh", "elf", "bin"
131)
132'''
133
134[[rule.threat]]
135framework = "MITRE ATT&CK"
136
137  [rule.threat.tactic]
138  name = "Persistence"
139  id = "TA0003"
140  reference = "https://attack.mitre.org/tactics/TA0003/"
141
142  [[rule.threat.technique]]
143  id = "T1505"
144  name = "Server Software Component"
145  reference = "https://attack.mitre.org/techniques/T1505/"
146
147    [[rule.threat.technique.subtechnique]]
148    id = "T1505.003"
149    name = "Web Shell"
150    reference = "https://attack.mitre.org/techniques/T1505/003/"
151
152[[rule.threat]]
153framework = "MITRE ATT&CK"
154
155  [rule.threat.tactic]
156  name = "Initial Access"
157  id = "TA0001"
158  reference = "https://attack.mitre.org/tactics/TA0001/"
159
160  [[rule.threat.technique]]
161  name = "Exploit Public-Facing Application"
162  id = "T1190"
163  reference = "https://attack.mitre.org/techniques/T1190/"
164
165[[rule.threat]]
166framework = "MITRE ATT&CK"
167
168  [[rule.threat.technique]]
169  id = "T1210"
170  name = "Exploitation of Remote Services"
171  reference = "https://attack.mitre.org/techniques/T1210/"
172
173  [rule.threat.tactic]
174  id = "TA0008"
175  name = "Lateral Movement"
176  reference = "https://attack.mitre.org/tactics/TA0008/"