title: Webshell Recon Detection Via CommandLine & Processes
id: f64e5c19-879c-4bae-b471-6d84c8339677
status: test
description: Looking for processes spawned by web server components that indicate reconnaissance by popular public domain webshells for whether perl, python or wget are installed.
author: Cian Heasley, Florian Roth
references:
   - https://ragged-lab.blogspot.com/2020/07/webshells-automating-reconnaissance.html
date: 2020/07/22
modified: 2022/03/17
tags:
   - attack.persistence
   - attack.t1505.003
logsource:
  category: process_creation
  product: windows
detection:
   selection_webserver_image:
      ParentImage|endswith:
         - '\w3wp.exe'
         - '\php-cgi.exe'
         - '\nginx.exe'
         - '\httpd.exe'
         - '\caddy.exe'
         - '\ws_tomcatservice.exe'
   selection_webserver_characteristics_tomcat1:
      ParentImage|endswith: 
         - '\java.exe'
         - '\javaw.exe'
      ParentImage|contains: 
         - '-tomcat-'
         - '\tomcat'
   selection_webserver_characteristics_tomcat2:
      ParentImage|endswith: 
         - '\java.exe'
         - '\javaw.exe'
      CommandLine|contains: 
         - 'catalina.jar'
         - 'CATALINA_HOME'
   recon:
      CommandLine|contains:
         - 'perl --help'
         - 'python --help'
         - 'wget --help'
         - 'perl -h'
   condition: 1 of selection* and recon
fields:
   - Image
   - CommandLine
   - ParentCommandLine
falsepositives:
   - Unknown
level: high
