Webshell Tool Reconnaissance Activity

Title: Webshell Tool Reconnaissance Activity
Status: test
Description:Detects processes spawned from web servers (PHP, Tomcat, IIS, etc.) that perform reconnaissance looking for the existence of popular scripting tools (perl, python, wget) on the system via the help commands
References:
  -https://ragged-lab.blogspot.com/2020/07/webshells-automating-reconnaissance.html
Author: Cian Heasley, Florian Roth (Nextron Systems)
Date: 2020-07-22
modified:2023-11-09
Tags:

• -'attack.persistence'
• -'attack.t1505.003'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_webserver_image:
    ParentImage|endswith:
      -'\caddy.exe'
      -'\httpd.exe'
      -'\nginx.exe'
      -'\php-cgi.exe'
      -'\w3wp.exe'
      -'\ws_tomcatservice.exe'

  selection_webserver_characteristics_tomcat1:
    ParentImage|endswith:
      -'\java.exe'
      -'\javaw.exe'

    ParentImage|contains:
      -'-tomcat-'
      -'\tomcat'

  selection_webserver_characteristics_tomcat2:
    ParentImage|endswith:
      -'\java.exe'
      -'\javaw.exe'

    CommandLine|contains:
      -'CATALINA_HOME'
      -'catalina.jar'

  selection_recon:
    CommandLine|contains:
      -'perl --help'
      -'perl -h'
      -'python --help'
      -'python -h'
      -'python3 --help'
      -'python3 -h'
      -'wget --help'

  condition:1 of selection_webserver_* and selection_recon
Falsepositives:
  -Unknown
Level: high