rules/web/web_webshell_keyword.yml

title: Webshell Detection by Keyword
id: 7ff9db12-1b94-4a79-ba68-a2402c5d6729
description: Detects webshells that use GET requests by keyword searches in URL strings
author: Florian Roth
logsource:
    category: webserver
detection:
    keywords:
        - =whoami
        - =net%20user
        - =cmd%20/c%20
    condition: keywords
fields:
    - client_ip
    - vhost
    - url
    - response
falsepositives:
    - Web sites like wikis with articles on os commands and pages that include the os commands in the URLs
    - User searches in search boxes of the respective website
level: high
Renamed rule files, new rules 2017-02-10 19:17:02 +01:00			`title: Webshell Detection by Keyword`
Added UUIDs to rules 2019-11-12 23:12:27 +01:00			`id: 7ff9db12-1b94-4a79-ba68-a2402c5d6729`
Fix typo 2018-09-06 20:20:11 -05:00			`description: Detects webshells that use GET requests by keyword searches in URL strings`
Added "logsource" sections and new rule 2017-02-19 00:31:59 +01:00			`author: Florian Roth`
			`logsource:`
Fixed rules 2017-09-11 00:35:52 +02:00			`category: webserver`
Renamed rule files, new rules 2017-02-10 19:17:02 +01:00			`detection:`
			`keywords:`
Added UUIDs to rules 2019-11-12 23:12:27 +01:00			`- =whoami`
			`- =net%20user`
			`- =cmd%20/c%20`
Rule fix 2017-02-22 22:42:35 +01:00			`condition: keywords`
Added field names to first rules 2017-09-12 23:54:04 +02:00			`fields:`
			`- client_ip`
Added vhost field to web rules 2017-09-17 00:20:17 +02:00			`- vhost`
Added field names to first rules 2017-09-12 23:54:04 +02:00			`- url`
			`- response`
Renamed rule files, new rules 2017-02-10 19:17:02 +01:00			`falsepositives:`
			`- Web sites like wikis with articles on os commands and pages that include the os commands in the URLs`
			`- User searches in search boxes of the respective website`
Levels to low, medium, high, critical 2017-02-16 18:02:26 +01:00			`level: high`
Rule: Linux: buffer overflows 2017-03-01 08:38:33 +01:00