SigmaHQ/rules/windows/sysmon/sysmon_webshell_detection.yml

title: Webshell Detection With Command Line Keywords
description: Detects certain command line parameters often used during reconnaissance activity via web shells
author: Florian Roth
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 1
        ParentImage:
          - '*\apache*'
          - '*\tomcat*'
          - '*\w3wp.exe'
          - '*\php-cgi.exe'
          - '*\nginx.exe'
          - '*\httpd.exe'
        CommandLine:
          - 'whoami'
          - 'net user'
          - 'ping -n'
          - 'systeminfo'
    condition: selection
fields:
    - CommandLine
    - ParentCommandLine
tags:
    - attack.privilege_escalation
    - attack.persistence
    - attack.t1100
falsepositives:
    - unknown
level: high
Modifications + Added Sysmon detection of Office binaries spawning Windows shells + Additional web servers added for webshell detection 2017-03-04 22:22:44 +00:00			`title: Webshell Detection With Command Line Keywords`
fixed typo 2018-07-16 21:13:24 +00:00			`description: Detects certain command line parameters often used during reconnaissance activity via web shells`
Added "logsource" sections and new rule 2017-02-18 23:31:59 +00:00			`author: Florian Roth`
			`logsource:`
Sysmon as 'service' of product 'windows' 2017-03-13 08:23:08 +00:00			`product: windows`
			`service: sysmon`
Renamed rule files, new rules 2017-02-10 18:17:02 +00:00			`detection:`
			`selection:`
Rule review and cleanup * removed unnecessary one element lists from definitions * converted some lists of one element maps to maps because the resulting OR linkage would cause wrong result. 2017-02-15 22:53:08 +00:00			`EventID: 1`
			`ParentImage:`
			`- '\apache'`
			`- '\tomcat'`
Modifications + Added Sysmon detection of Office binaries spawning Windows shells + Additional web servers added for webshell detection 2017-03-04 22:22:44 +00:00			`- '*\w3wp.exe'`
			`- '*\php-cgi.exe'`
			`- '*\nginx.exe'`
			`- '*\httpd.exe'`
			`CommandLine:`
Rule review and cleanup * removed unnecessary one element lists from definitions * converted some lists of one element maps to maps because the resulting OR linkage would cause wrong result. 2017-02-15 22:53:08 +00:00			`- 'whoami'`
			`- 'net user'`
			`- 'ping -n'`
Modifications + Added Sysmon detection of Office binaries spawning Windows shells + Additional web servers added for webshell detection 2017-03-04 22:22:44 +00:00			`- 'systeminfo'`
Renamed rule files, new rules 2017-02-10 18:17:02 +00:00			`condition: selection`
Added field names to first rules 2017-09-12 21:54:04 +00:00			`fields:`
			`- CommandLine`
			`- ParentCommandLine`
added att&ck tag 2018-08-07 06:49:05 +00:00			`tags:`
			`- attack.privilege_escalation`
			`- attack.persistence`
			`- attack.t1100`
Renamed rule files, new rules 2017-02-10 18:17:02 +00:00			`falsepositives:`
			`- unknown`
Levels to low, medium, high, critical 2017-02-16 17:02:26 +00:00			`level: high`