rce-on-vulnerable-server

Description

This query was originally published in the threat analytics report, Sysrv botnet evolution. Sysrv is a Go-based botnet that targets both Windows and Linux servers, and steals resources to mine cryptocurrency. The following query finds instances of remote code execution on a vulnerable Linux server.

Query · kql

DeviceProcessEvents
| where InitiatingProcessCommandLine has "php-cgi.exe"
| where ProcessCommandLine has_all ('curl -fsSL', '/ldr.sh', 'wget -q -O')
Raw source rce-on-vulnerable-server · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: ec7ec6bb-c15a-4d2b-9682-a92bf5a22c8e
name: rce-on-vulnerable-server
description: |
  This query was originally published in the threat analytics report, Sysrv botnet evolution.
  Sysrv is a Go-based botnet that targets both Windows and Linux servers, and steals resources to mine cryptocurrency.
  The following query finds instances of remote code execution on a vulnerable Linux server.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
query: |
  DeviceProcessEvents
  | where InitiatingProcessCommandLine has "php-cgi.exe"
  | where ProcessCommandLine has_all ('curl -fsSL', '/ldr.sh', 'wget -q -O')

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.