Webshell Remote Command Execution

 1title: Webshell Remote Command Execution
 2id: c0d3734d-330f-4a03-aae2-65dacc6a8222
 3status: test
 4description: Detects possible command execution by web application/web shell
 5references:
 6    - Personal Experience of the Author
 7author: Ilyas Ochkov, Beyu Denis, oscd.community
 8date: 2019-10-12
 9modified: 2022-12-25
10tags:
11    - attack.persistence
12    - attack.t1505.003
13logsource:
14    product: linux
15    service: auditd
16detection:
17    selection:
18        # You need to add to the following rules to your auditd.conf config:
19        #   -a always,exit -F arch=b32 -S execve -F euid=33 -k detect_execve_www
20        #   -a always,exit -F arch=b64 -S execve -F euid=33 -k detect_execve_www
21        # Change the number "33" to the ID of your WebServer user. Default: www-data:x:33:33
22        type: 'SYSCALL'
23        syscall: 'execve'
24        key: 'detect_execve_www'
25    condition: selection
26falsepositives:
27    - Admin activity
28    - Crazy web applications
29level: critical