Webshell ReGeorg Detection Via Web Logs

Title: Webshell ReGeorg Detection Via Web Logs
Status: test
Description:Certain strings in the uri_query field when combined with null referer and null user agent can indicate activity associated with the webshell ReGeorg.
References:
  -https://community.rsa.com/community/products/netwitness/blog/2019/02/19/web-shells-and-netwitness-part-3
  -https://github.com/sensepost/reGeorg
Author: Cian Heasley
Date: 2020-08-04
modified:2023-01-02
Tags:

• -'attack.persistence'
• -'attack.t1505.003'

Logsource:

• category: webserver

Detection:
  selection:
    cs-uri-query|contains:
      -'cmd=read'
      -'connect&target'
      -'cmd=connect'
      -'cmd=disconnect'
      -'cmd=forward'

  filter:
    cs-referer: 'None'
    cs-user-agent: 'None'
    cs-method: 'POST'
  condition:selection and filter
Falsepositives:
  -Web applications that use the same URL parameters as ReGeorg
Level: high