[New Rule] Name of rule: Web Shell Network Activity Detection #5278
Description
Description
Detects network activity initiated by web server processes that may indicate web shell execution.
Target Ruleset
linux
Target Rule Type
Custom (KQL or Lucene)
Tested ECS Version
9.2.0
Query
process where host.os.type == "linux" and event.type == "start" and
/* Process spawned by web server /
process.parent.name in ("apache", "apache2", "httpd", "nginx", "php-fpm", "php-cgi", "lighttpd") and
(
/ Reverse shell tools */
process.name in ("bash", "sh", "dash", "zsh", "nc", "ncat", "netcat", "socat") or
/* Network utilities */
process.name in ("curl", "wget", "ftp", "tftp", "scp", "sftp", "ssh", "telnet") or
(
process.name in ("python", "python2", "python3", "perl", "ruby", "php") and
(
process.args : ("socket", "connect", "tcp", "http", "urllib") or
process.args : ("-c", "-e")
)
) or
/* Network scanning/enumeration */
process.name in ("nmap", "masscan", "ping", "traceroute", "dig", "nslookup", "host")
) and
/* Exclude legitimate application behaviors /
not process.args : (
"localhost", "127.0.0.1", "::1*",
"/usr/share/", "/usr/lib/"
) and
not process.name in ("curl", "wget") or (
process.name in ("curl", "wget") and
not process.args : ("github.com", "packagist.org", "wordpress.org", "npmjs.com")
)
New fields required in ECS/data sources for this rule?
No response
Related issues or PRs
No response
References
No response
Redacted Example Data
No response