webshell_detection_with_command_line_keywords

rule webshell_detection_with_command_line_keywords {
 meta:
    author = "Florian Roth"
    description = "Detects certain command line parameters often used during reconnaissance activity via web shells  License: https://github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md."
    reference = "https://tdm.socprime.com/tdm/info/sNMBtl0lkRXL"
    version = "0.01"
    created = "2017/01/01"
    category = "process_creation"
    product = "windows"
    mitre = "privilege_escalation, persistence, t1100"

  events:
((re.regex($selection.principal.process.file.full_path, `.*\\apache.*`) or re.regex($selection.principal.process.file.full_path, `.*\\tomcat.*`) or re.regex($selection.principal.process.file.full_path, `.*\\w3wp\.exe`) or re.regex($selection.principal.process.file.full_path, `.*\\php-cgi\.exe`) or re.regex($selection.principal.process.file.full_path, `.*\\nginx\.exe`) or re.regex($selection.principal.process.file.full_path, `.*\\httpd\.exe`)) and (re.regex($selection.target.process.command_line, `.*whoami.*`) or re.regex($selection.target.process.command_line, `.*net user .*`) or re.regex($selection.target.process.command_line, `.*ping -n .*`) or re.regex($selection.target.process.command_line, `.*systeminfo`) or re.regex($selection.target.process.command_line, `.*&cd&echo.*`) or re.regex($selection.target.process.command_line, `.*cd /d.*`)) and ($selection.metadata.product_event_type = "4688" or $selection.metadata.product_event_type = "1"))

  condition:
    $selection
}