Potential Polyglot Bypass File Created by Web Server

  1[metadata]
  2creation_date = "2026/09/07"
  3integration = ["endpoint"]
  4maturity = "production"
  5min_stack_version = "9.3.0"
  6min_stack_comments = "The file.Ext.* fields for file events were introduced in 9.3.0, and are required for this rule to function."
  7updated_date = "2026/09/07"
  8
  9[rule]
 10author = ["Elastic"]
 11description = """
 12This rule detects when a web server process creates a file with a file extension that does not
 13match the file content based on the file header bytes. This is a common technique used by attackers
 14to bypass security measures and to hide the true nature of the file.
 15"""
 16from = "now-9m"
 17index = ["logs-endpoint.events.file*"]
 18language = "eql"
 19license = "Elastic License v2"
 20name = "Potential Polyglot Bypass File Created by Web Server"
 21note = """## Triage and analysis
 22
 23> **Disclaimer**:
 24> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 25
 26### Investigating Potential Polyglot Bypass File Created by Web Server
 27
 28This rule identifies Linux web server processes creating files with script or executable extensions whose header bytes indicate a different format, which may expose an upload-validation bypass or concealed malicious payload. An attacker could upload a JPEG/PHP polyglot named `avatar.php`, pass image-type validation using valid JPEG header bytes, and later execute appended PHP code as a web shell.
 29
 30### Possible investigation steps
 31
 32- Preserve the file and record its path, owner, permissions, timestamps, hash, and web-accessibility before quarantining it for static analysis.
 33- Compare the declared extension, detected file type, and full contents to identify appended server-side code, embedded executables, obfuscation, or multiple valid file formats.
 34- Correlate the creation time with reverse-proxy, web access, application, authentication, and upload logs to identify the source IP, account, request URI, user agent, and response status.
 35- Review related process activity and network connections for execution of the file, shell or interpreter launches, persistence changes, credential access, or outbound command-and-control traffic.
 36- Determine whether the application legitimately creates this file type and, if malicious or unexplained, isolate the host, block the artifact and source indicators, remove exposed files, and remediate the upload-validation weakness.
 37
 38### False positive analysis
 39
 40- A legitimate upload or media-processing workflow may save an image, document, or RIFF file with a script-like extension because of application naming logic, so verify the originating request, expected application behavior, and absence of appended executable code.
 41- A deployment, testing, or packaging process running under a web server account may create a valid ELF or archive-derived artifact with a monitored extension, so confirm the change against authorized deployment records and validate the file hash, contents, path, and owner.
 42
 43### Response and remediation
 44
 45- Isolate the affected web server and any systems contacted by the malicious file while preserving the polyglot artifact, relevant logs, and volatile evidence.
 46- Quarantine the file, block its hash and associated source addresses, and remove related web shells, dropped payloads, unauthorized accounts, and altered application files.
 47- Eliminate persistence from cron jobs, systemd units, startup scripts, SSH `authorized_keys`, web server modules, application plugins, and writable web-root directories.
 48- Rebuild the server from a known-good image, restore validated application content and configuration, patch exploited components, and rotate credentials or secrets accessible to the web server account.
 49- Escalate immediately to incident response and expand scoping if the file executed, spawned a shell or interpreter, initiated outbound connections, accessed credentials, or enabled lateral movement.
 50- Prevent recurrence by validating complete file content rather than extensions or headers, renaming uploads, storing them outside executable web paths, disabling script execution in upload directories, and enforcing least-privilege permissions.
 51"""
 52risk_score = 73
 53rule_id = "82f6fa8d-ea35-4329-b334-f1a557dc58c7"
 54setup = """## Setup
 55
 56This rule requires data coming in from Elastic Defend.
 57
 58### Elastic Defend Integration Setup
 59Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
 60
 61#### Prerequisite Requirements:
 62- Fleet is required for Elastic Defend.
 63- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
 64
 65#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
 66- Go to the Kibana home page and click "Add integrations".
 67- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
 68- Click "Add Elastic Defend".
 69- Configure the integration name and optionally add a description.
 70- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
 71- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
 72- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
 73- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
 74For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
 75- Click "Save and Continue".
 76- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
 77For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
 78
 79Elastic Defend integration does not collect advanced file information (such as the different file.Ext.* fields) by default.
 80In order to capture this behavior, this rule requires a specific configuration option set within the advanced settings of the Elastic Defend integration.
 81 #### To set up advanced file information capture for an Elastic Agent policy:
 82- Go to “Security → Manage → Policies”.
 83- Select an “Elastic Agent policy”.
 84- Click “Show advanced settings”.
 85- Scroll down or search for “linux.advanced.events.populate_file_data”.
 86- For this rule the linux.advanced.events.populate_file_data variable should be set to "true".
 87- Click “Save”.
 88After saving the integration change, the Elastic Agents running this policy will be updated and the rule will function properly.
 89"""
 90severity = "high"
 91tags = [
 92    "Domain: Endpoint",
 93    "OS: Linux",
 94    "Use Case: Threat Detection",
 95    "Use Case: Vulnerability",
 96    "Tactic: Persistence",
 97    "Tactic: Initial Access",
 98    "Tactic: Lateral Movement",
 99    "Data Source: Elastic Defend",
100    "Rule Type: Event Correlation (EQL)",
101    "Resources: Investigation Guide"
102]
103timestamp_override = "event.ingested"
104type = "eql"
105query = '''
106file where host.os.type == "linux" and event.action != "deletion" and
107(
108  process.name in (
109    "nginx", "apache2", "httpd", "caddy", "lighttpd", "httpd.worker", "httpd-worker", "httpd-prefork",
110    "php-cgi", "php-fcgi", "php-cgi.cagefs", "frankenphp", "lshttpd", "litespeed", "openlitespeed",
111    "fcgiwrap", "uwsgi", "daphne", "uvicorn", "hypercorn", "granian", "waitress-serve", "flask", "puma",
112    "unicorn", "unicorn_rails", "thin", "rackup", "mongrel_rails", "starman", "plackup", "twiggy",
113    "hypnotoad", "starlet", "unitd", "unitd-debug", "java", "node", "nodejs"
114  ) or
115  process.name like (
116    "php-fpm*", "lsphp*", "gunicorn*", "*.cgi", "*.fcgi", "mono*", "xsp*", "mod-mono-server*",
117    "fastcgi-mono-server*", "python*", "ruby*", "perl*", "lua*"
118  )
119) and
120file.extension in~ ( 
121  "php", "phtml", "pht", "php3", "php4", "php5", "php7", "phar",
122  "asp", "aspx", "ashx", "asmx", "ascx", "cshtml",
123  "jsp", "jspx", "jsx", "jspf", "tag", "tagx", "war", "ear",
124  "js", "mjs", "cjs", "ts", "mts", "cts", "tsx",
125  "razor",
126  "py", "wsgi", "cgi", "fcgi", "pyc",
127  "erb", "ru",
128  "psgi",
129  "lua", "luac",
130  "sh", "elf"
131) and
132file.Ext.header_bytes like (
133  "ffd8ff*",                // JPEG / JPG
134  "89504e470d0a1a0a*",      // PNG 
135  "47494638*",              // GIF (GIF87a / GIF89a)
136  "00000100*",              // ICO
137  "00000200*",              // CUR
138  "424d*",                  // BMP
139  "49492a00*",              // TIFF (little endian)
140  "4d4d002a*",              // TIFF (big endian)
141  "52494646*",              // RIFF container (WEBP/AVI/etc)
142  "255044462d*",            // PDF
143  "7f454c46*"               // ELF
144)
145'''
146
147[[rule.threat]]
148framework = "MITRE ATT&CK"
149
150  [rule.threat.tactic]
151  name = "Persistence"
152  id = "TA0003"
153  reference = "https://attack.mitre.org/tactics/TA0003/"
154
155  [[rule.threat.technique]]
156  id = "T1505"
157  name = "Server Software Component"
158  reference = "https://attack.mitre.org/techniques/T1505/"
159
160    [[rule.threat.technique.subtechnique]]
161    id = "T1505.003"
162    name = "Web Shell"
163    reference = "https://attack.mitre.org/techniques/T1505/003/"
164
165[[rule.threat]]
166framework = "MITRE ATT&CK"
167
168  [rule.threat.tactic]
169  name = "Initial Access"
170  id = "TA0001"
171  reference = "https://attack.mitre.org/tactics/TA0001/"
172
173  [[rule.threat.technique]]
174  name = "Exploit Public-Facing Application"
175  id = "T1190"
176  reference = "https://attack.mitre.org/techniques/T1190/"
177
178[[rule.threat]]
179framework = "MITRE ATT&CK"
180
181  [[rule.threat.technique]]
182  id = "T1210"
183  name = "Exploitation of Remote Services"
184  reference = "https://attack.mitre.org/techniques/T1210/"
185
186  [rule.threat.tactic]
187  id = "TA0008"
188  name = "Lateral Movement"
189  reference = "https://attack.mitre.org/tactics/TA0008/"