Techniques
Sample rules
Potential Shell via Web Server
- source: elastic
- technicques:
- T1505
Description
Identifies suspicious commands executed via a web server, which may suggest a vulnerability and remote shell access.
Detection logic
event.category:process and host.os.type:linux and event.type:(start or process_started) and
process.name:(bash or dash or ash or zsh or "python*" or "perl*" or "php*") and
process.parent.name:("apache" or "nginx" or "www" or "apache2" or "httpd" or "www-data")
Suspicious Child Execution via Web Server
- source: elastic
- technicques:
- T1190
- T1505
Description
Identifies suspicious child processes executed via a web server, which may suggest a vulnerability and remote shell access. Attackers may exploit a vulnerability in a web application to execute commands via a web server, or place a backdoor file that can be abused to gain code execution as a mechanism for persistence.
Detection logic
process where host.os.type == "linux" and event.type == "start" and process.parent.executable != null and (
process.parent.name like (
"apache", "nginx", "apache2", "httpd", "lighttpd", "caddy", "php-fpm*", "mongrel_rails", "haproxy",
"gunicorn", "uwsgi", "openresty", "cherokee", "h2o", "resin", "puma", "unicorn", "traefik", "uvicorn",
"tornado", "hypercorn", "daphne", "twistd", "yaws", "webfsd", "httpd.worker", "flask", "rails", "mongrel",
"php-cgi", "php-fcgi", "php-cgi.cagefs", "catalina.sh", "hiawatha", "lswsctrl"
) or
user.name in ("apache", "www-data", "httpd", "nginx", "lighttpd", "tomcat", "tomcat8", "tomcat9") or
user.id in ("33", "498", "48") or
(process.name == "java" and ?process.working_directory like "/u0?/*")
) and (
process.executable like (
"/tmp/*", "/var/tmp/*", "/dev/shm/*", "./*", "/run/*", "/var/run/*", "/boot/*", "/sys/*", "/lost+found/*",
"/proc/*", "/var/mail/*", "/var/www/*", "/home/*", "/root/*"
) or
process.name like~ (
// Hidden processes
".*",
// Suspicious file formats
"*.elf", "*.sh", "*.py", "*.rb", "*.pl", "*.lua*", "*.php*", ".js",
// Scheduled tasks
"systemd", "cron", "crond",
// Network utilities often used for reverse shells
"nc", "netcat", "ncat", "telnet", "socat", "openssl", "nc.openbsd", "ngrok", "nc.traditional",
// Cloud CLI
"az", "gcloud", "aws",
// Misc. tools
"whoami", "ifconfig", "ip", "ss", "top", "htop", "df", "du", "lsblk", "lsof", "tcpdump",
"strace", "ltrace", "curl", "wget", "dig", "nslookup", "host", "nmap", "arp", "traceroute"
)
)