WebShell detections

[ravivittal]

Hello Experts, Can someone please provide some sample rules to detect WebShell detections?

In Essense are trying to look for events related to file creation, modification, or deletion, particularly in commonly targeted locations like web application root directories (e.g., /var/www/html). Focus on events involving executable files with unusual names or suspicious scripts.

[tameri]

@ravivittal , did you check these rules?
https://github.com/chronicle/detection-rules/blob/main/soc_prime_rules/threat_hunting/process_creati...

https://github.com/chronicle/detection-rules/blob/main/soc_prime_rules/threat_hunting/process_creati...

[ravivittal]

Thank you, let me test this and circle back. Apprecaite the quick ressponse!

[jstoner]

Those are some decent places to start regarding the different places a webshell might manifest itself.

From there using something like this to associated the webshell to the endpoint behavior might be appropriate. This will likely require some tuning but the network event has to occur before the endpoint (in theory), the endpoint principal should be the webshell network logging target and we are looking for process launch and file creation events (or others). From there you could use the endpoint event variable to carve down further on weird stuff and then set your match window accordingly on that common IP address.

   $endpoint.metadata.event_type = "PROCESS_LAUNCH" or $endpoint.metadata.event_type = "FILE_CREATION"
   $endpoint.principal.ip = $network.target.ip
   $endpoint.metadata.event_timestamp.seconds  < $network.metadata.event_timestamp.seconds