Webshell Remote Command Execution
Detects possible command execution by web application/web shell
Sigma rule (View on GitHub)
1title: Webshell Remote Command Execution
2id: c0d3734d-330f-4a03-aae2-65dacc6a8222
3status: test
4description: Detects possible command execution by web application/web shell
5references:
6 - Personal Experience of the Author
7author: Ilyas Ochkov, Beyu Denis, oscd.community
8date: 2019/10/12
9modified: 2022/12/25
10tags:
11 - attack.persistence
12 - attack.t1505.003
13logsource:
14 product: linux
15 service: auditd
16detection:
17 selection:
18 # You need to add to the following rules to your auditd.conf config:
19 # -a always,exit -F arch=b32 -S execve -F euid=33 -k detect_execve_www
20 # -a always,exit -F arch=b64 -S execve -F euid=33 -k detect_execve_www
21 # Change the number "33" to the ID of your WebServer user. Default: www-data:x:33:33
22 type: 'SYSCALL'
23 syscall: 'execve'
24 key: 'detect_execve_www'
25 condition: selection
26falsepositives:
27 - Admin activity
28 - Crazy web applications
29level: critical
References
Related rules
- UAC Bypass With Fake DLL
- Creation Of An User Account
- Suspicious Fsutil Execution Allowing Remote Connections
- Scheduled Cron Task/Job - Linux
- Scheduled Cron Task/Job - MacOs