Windows Webshell Strings

Title: Windows Webshell Strings
Status: test
Description:Detects common commands used in Windows webshells
References:
  -https://bad-jubies.github.io/RCE-NOW-WHAT/
  -https://m365internals.com/2022/10/07/hunting-in-on-premises-exchange-server-logs/
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2017-02-19
modified:2022-11-18
Tags:

• -'attack.persistence'
• -'attack.t1505.003'

Logsource:

• category: webserver

Detection:
  selection_method:
    cs-method: 'GET'
  selection_keywords:
    - '=whoami'
    - '=net%20user'
    - '=net+user'
    - '=net%2Buser'
    - '=cmd%20/c%'
    - '=cmd+/c+'
    - '=cmd%2B/c%'
    - '=cmd%20/r%'
    - '=cmd+/r+'
    - '=cmd%2B/r%'
    - '=cmd%20/k%'
    - '=cmd+/k+'
    - '=cmd%2B/k%'
    - '=powershell%'
    - '=powershell+'
    - '=tasklist%'
    - '=tasklist+'
    - '=wmic%'
    - '=wmic+'
    - '=ssh%'
    - '=ssh+'
    - '=python%'
    - '=python+'
    - '=python3%'
    - '=python3+'
    - '=ipconfig'
    - '=wget%'
    - '=wget+'
    - '=curl%'
    - '=curl+'
    - '=certutil'
    - '=copy%20%5C%5C'
    - '=dsquery%'
    - '=dsquery+'
    - '=nltest%'
    - '=nltest+'
  condition:all of selection_*
Falsepositives:
  -Web sites like wikis with articles on os commands and pages that include the os commands in the URLs
  -User searches in search boxes of the respective website
Level: high