2017-02-10 19:17:02 +01:00
|
|
|
title: Webshell Detection by Keyword
|
2017-02-19 00:31:59 +01:00
|
|
|
description: Detects webshells that use GET requests by keyword sarches in URL strings
|
|
|
|
|
author: Florian Roth
|
|
|
|
|
logsource:
|
|
|
|
|
type: webserver
|
2017-02-10 19:17:02 +01:00
|
|
|
detection:
|
|
|
|
|
keywords:
|
|
|
|
|
- '=whoami'
|
|
|
|
|
- '=net%20user'
|
|
|
|
|
- '=cmd%20/c%20'
|
2017-02-22 22:42:35 +01:00
|
|
|
condition: keywords
|
2017-02-10 19:17:02 +01:00
|
|
|
falsepositives:
|
|
|
|
|
- Web sites like wikis with articles on os commands and pages that include the os commands in the URLs
|
|
|
|
|
- User searches in search boxes of the respective website
|
2017-02-16 18:02:26 +01:00
|
|
|
level: high
|
2017-03-01 08:38:33 +01:00
|
|
|
|
