Linux Webshell Indicators

Title: Linux Webshell Indicators
Status: test
Description:Detects suspicious sub processes of web server processes
References:
  -https://www.acunetix.com/blog/articles/web-shells-101-using-php-introduction-web-shells-part-2/
  -https://media.defense.gov/2020/Jun/09/2002313081/-1/-1/0/CSI-DETECT-AND-PREVENT-WEB-SHELL-MALWARE-20200422.PDF
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2021-10-15
modified:2026-08-19
Tags:

• -'attack.persistence'
• -'attack.t1505.003'

Logsource:

• product: linux
• category: process_creation

Detection:
  selection_parent_general:
    ParentImage|endswith:
      -'/httpd'
      -'/lighttpd'
      -'/nginx'
      -'/apache2'
      -'/node'
      -'/caddy'

  selection_parent_tomcat:
    ParentCommandLine|contains|all:
      -'/bin/java'
      -'tomcat'

  selection_parent_websphere:
    ParentCommandLine|contains|all:
      -'/bin/java'
      -'websphere'

  selection_child_processes:
    Image|endswith:
      -'/whoami'
      -'/ifconfig'
      -'/ip'
      -'/bin/uname'
      -'/bin/cat'
      -'/bin/crontab'
      -'/hostname'
      -'/iptables'
      -'/netstat'
      -'/pwd'
      -'/route'

  filter_optional_ip_neigh:
    ParentImage|endswith: '/node'
    CommandLine|contains: 'ip neigh show'
  condition:1 of selection_parent_* and selection_child_processes and not 1 of filter_optional_*
Falsepositives:
  -Web applications that invoke Linux command line tools
Level: high