title: Webshell Recon Detection Via CommandLine & Processes
ruletype: Sigma
author: Cian Heasley
date: 2020/07/22
description: Looking for processes spawned by web server components that indicate
  reconnaissance by popular public domain webshells for whether perl, python or wget
  are installed.
detection:
  SELECTION_1:
    EventID: 1
  SELECTION_2:
    ParentImage:
    - '*\apache*'
    - '*\tomcat*'
  SELECTION_3:
    ParentImage:
    - '*\w3wp.exe'
    - '*\php-cgi.exe'
    - '*\nginx.exe'
    - '*\httpd.exe'
  SELECTION_4:
    Image:
    - '*\cmd.exe'
  SELECTION_5:
    CommandLine:
    - '*perl --help*'
    - '*python --help*'
    - '*wget --help*'
    - '*perl -h*'
  condition: (SELECTION_1 and (SELECTION_2 or SELECTION_3) and (SELECTION_4 and SELECTION_5))
falsepositives:
- unknown
fields:
- Image
- CommandLine
- ParentCommandLine
id: f64e5c19-879c-4bae-b471-6d84c8339677
level: high
logsource:
  category: process_creation
  product: windows
modified: 2021/11/27
references:
- https://ragged-lab.blogspot.com/2020/07/webshells-automating-reconnaissance.html
status: test
tags:
- attack.persistence
- attack.t1505.003
- attack.privilege_escalation
- attack.t1100