Webshell Tool Reconnaissance Activity

Severity: high
Author: Cian Heasley, Florian Roth (Nextron Systems)
Source: upstream

Detects processes spawned from web servers (PHP, Tomcat, IIS, etc.) that perform reconnaissance looking for the existence of popular scripting tools (perl, python, wget) on the system via the help commands

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1505.003` Server Software Component: Web Shell

Event coverage

Provider	Event ID	Title
Sysmon	1	Process creation
Security-Auditing	4688	A new process has been created.

Stages and Predicates

Stage 1: `1 of selection_webserver_image`

or:
ParentImage|endswith: '\caddy.exe'
ParentImage|endswith: '\httpd.exe'
ParentImage|endswith: '\nginx.exe'
ParentImage|endswith: '\php-cgi.exe'
ParentImage|endswith: '\w3wp.exe'
ParentImage|endswith: '\ws_tomcatservice.exe'

Stage 2: `1 of selection_webserver_characteristics_tomcat1`

or:
ParentImage|endswith: '\java.exe'
ParentImage|endswith: '\javaw.exe'
or:
ParentImage|contains: -tomcat-
ParentImage|contains: '\tomcat'

Stage 3: `1 of selection_webserver_characteristics_tomcat2`

or:
CommandLine|contains: CATALINA_HOME
CommandLine|contains: catalina.jar
or:
ParentImage|endswith: '\java.exe'
ParentImage|endswith: '\javaw.exe'

Stage 4: `selection_recon`

or:
CommandLine|contains: 'perl --help'
CommandLine|contains: 'perl -h'
CommandLine|contains: 'python --help'
CommandLine|contains: 'python -h'
CommandLine|contains: 'python3 --help'
CommandLine|contains: 'python3 -h'
CommandLine|contains: 'wget --help'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`CommandLine`	match	`CATALINA_HOME` corpus 3 (sigma 3) `catalina.jar` corpus 3 (sigma 3) `perl --help` `perl -h` `python --help` `python -h` `python3 --help` `python3 -h` `wget --help`
`ParentImage`	ends_with	`\caddy.exe` corpus 4 (sigma 4) `\httpd.exe` corpus 6 (sigma 6) `\java.exe` corpus 7 (sigma 7) `\javaw.exe` corpus 5 (sigma 5) `\nginx.exe` corpus 6 (sigma 6) `\php-cgi.exe` corpus 6 (sigma 6) `\w3wp.exe` corpus 8 (sigma 8) `\ws_tomcatservice.exe` corpus 3 (sigma 3)
`ParentImage`	match	`-tomcat-` corpus 4 (sigma 4) `\tomcat` corpus 6 (sigma 6)

Webshell Tool Reconnaissance Activity

MITRE ATT&CK coverage

Event coverage

Stages and Predicates

Stage 1: 1 of selection_webserver_image

Stage 2: 1 of selection_webserver_characteristics_tomcat1

Stage 3: 1 of selection_webserver_characteristics_tomcat2

Stage 4: selection_recon

Indicators

Stage 1: `1 of selection_webserver_image`

Stage 2: `1 of selection_webserver_characteristics_tomcat1`

Stage 3: `1 of selection_webserver_characteristics_tomcat2`

Stage 4: `selection_recon`