Payload Execution by Web Server
Description
This rule detects when a web server executes a payload. Attackers may exploit RCE or file upload vulnerabilities to execute malicious payloads on web servers to gain/maintain access and to establish a command and control channel.
Query · eql
process where event.type == "start" and event.action == "exec" and process.parent.interactive == false and (
process.parent.name in (
"nginx", "apache2", "httpd", "caddy", "mongrel_rails", "uwsgi", "daphne", "httpd.worker", "flask",
"php-cgi", "php-fcgi", "php-cgi.cagefs", "lswsctrl", "varnishd", "uvicorn", "waitress-serve", "starman",
"frankenphp", "zabbix_server", "asterisk", "sw-engine-fpm"
) or
process.parent.name like ("php-fpm*", "gunicorn*", "*.cgi", "*.fcgi") or
(
process.parent.name like "ruby*" and
process.parent.command_line like~ ("*puma*", "*rails*", "*passenger*") and
not process.parent.command_line == "sh -c /usr/bin/lsb_release -cidvr 2>/dev/null"
) or
(
process.parent.name like "python*" and
process.parent.command_line like~ (
"*hypercorn*", "*flask*", "*uvicorn*", "*django*", "*app.py*", "*server.py*", "*wsgi.py*", "*asgi.py*"
)
) or
(process.parent.name like "perl*" and process.parent.command_line like~ "*plackup*") or
(process.parent.name == "java" and process.parent.args like~ (
/* Tomcat */
"org.apache.catalina.startup.Bootstrap", "-Dcatalina.base=*",
/* Jetty */
"org.eclipse.jetty.start.Main", "-Djetty.home=*",
/* WildFly / JBoss */
"org.jboss.modules.Main", "-Djboss.home.dir=*",
/* WebLogic */
"weblogic.Server", "-Dweblogic.Name=*", "*weblogic-launcher.jar*",
/* WebSphere traditional + Liberty */
"com.ibm.ws.runtime.WsServer", "com.ibm.ws.kernel.boot.cmdline.Bootstrap",
/* GlassFish */
"com.sun.enterprise.glassfish.bootstrap.ASMain",
/* Resin */
"com.caucho.server.resin.Resin",
/* Spring Boot */
"org.springframework.boot.loader.*",
/* Quarkus */
"*quarkus-run.jar*", "io.quarkus.runner.GeneratedMain",
/* Micronaut */
"io.micronaut.runtime.Micronaut",
/* Dropwizard */
"io.dropwizard.cli.ServerCommand",
/* Play */
"play.core.server.ProdServerStart",
/* Helidon */
"io.helidon.microprofile.server.Main", "io.helidon.webserver*",
/* Vert.x */
"io.vertx.core.Launcher",
/* Keycloak */
"org.keycloak*",
/* Apereo CAS */
"org.apereo.cas*",
/* Elasticsearch */
"org.elasticsearch.bootstrap.Elasticsearch",
/* Atlassian / Gerrit */
"com.atlassian.jira.startup.Launcher", "*BitbucketServerLauncher*", "com.google.gerrit.pgm.Daemon",
/* Solr */
"*-Dsolr.solr.home=*",
/* Jenkins */
"*jenkins.war*"
)
)
) and
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "busybox") and
process.args in ("-c", "-cl", "-lc") and (
process.command_line like~ (
/* Suspicious Paths */
"* /tmp/* ", "* /var/tmp/* ", "* /dev/shm/*", "* /run/*", "* /var/run/*",
/* Encoding, Decoding & Piping */
"*|sh", "*| sh *", "*| sh ", "*|bash*", "*| bash*", "*|zsh*", "*| zsh*", "*|dash*", "*| dash*",
"*|python*", "*| python*", "*|php*", "*| php*", "*|perl*", "*| perl*", "*|ruby*", "*| ruby*",
"*|node*", "*| node*", "*|lua*", "*| lua*", "*|busybox*", "*| busybox*", "*|*base64 -d*", "*|*base64 --decode*",
"*|*base64 --decode*", "*|*openssl base64 -d*", "*xxd *", "*| openssl*enc * -d *", "*b64decode -r*",
/* Interpreter Execution */
"*python -c*", "*python3 -c*", "*php -r*", "*perl -e*", "*ruby -e*", "*lua -e*", "*node -e *",
/* Reverse Shells */
"*netcat *", "* nc *", "*ncat *", "*/dev/tcp*", "*/dev/udp/*", "*socat *", "*openssl*s_client *", "*stty*raw*-echo*",
"*mkfifo /tmp/*",
/* File Access */
"*>*/etc/cron*", "*crontab*", "*/etc/ssh*", "*/home/*/.ssh/*", "*/root/.ssh*", "*~/.ssh/*", "*/etc/shadow*",
"*/etc/passwd*", "*/etc/master.passwd*",
/* Enumeration & Discovery */
"*/etc/hosts*", "*/etc/resolv.conf*", "*/etc/hostname*", "*/etc/issue*", "*/etc/os-release*", "*lsb_release*",
"*/proc/*/environ*", "*sudo -l*", "*/proc/*/cgroup*", "*dockerenv*", "*/proc/*/mountinfo*", "*printenv*",
"*cat*.env *", "*getcap*", "*capsh*", "*find / *", "*netstat *",
/* AWS Credentials */
"*aws_access_key_id*", "*aws_secret_access_key*", "*aws_session_token*", "*accesskeyid*", "*secretaccesskey*",
"*.aws/credentials*", "*/.aws/config*",
/* Azure Credentials */
"*AZURE_CLIENT_ID*", "*AZURE_TENANT_ID*", "*AZURE_CLIENT_SECRET*", "*AZURE_FEDERATED_TOKEN_FILE*",
"*IDENTITY_ENDPOINT*", "*IDENTITY_HEADER*", "*MSI_ENDPOINT*", "*MSI_SECRET*", "*/.azure/*",
"*/run/secrets/azure/*",
/* GCP Credentials */
"*/.config/gcloud/*", "*application_default_credentials.json*", "*type: service_account*",
"*client_email*", "*private_key_id*", "*/run/secrets/google/*", "*GOOGLE_APPLICATION_CREDENTIALS*",
/* Misc. Cloud */
"*/.docker/config.json*", "*/.npmrc*", "*/secrets/kubernetes.io/serviceaccount/*",
/* Helpers */
"*timeout *sh -c *", "*env *sh *-c*", "*exec -a*",
/* Miscellaneous */
"*chattr *", "*busybox *", "*#!*", "*chmod +x *", "*chmod 777*", "*chpasswd*",
"*<?php*?>*", "*kworker*",
/* Decompression */
"*gzip -*d *", "*bzip2 -*d *", "*xz -*d *", "*tar -*x*",
/* Path Traversal */
"*../../../*etc/*", "*/.../*", "*../../../*home/*/*", "*../../../*root/*",
/* File Upload/Download */
"*pastebin.com*", "*transfer.sh*", "*bashupload.com*"
) or
process.args in ("id", "whoami", "hostname")
) and
not (
(
process.parent.name == "nginx" and
(
process.args like ("chmod 777 /etc/resty-*", "resty*") or
process.command_line like ("sh -c*/tmp/lua_* 2> /tmp/lua_*", "sh -c gcc -print-multiarch 2>/dev/null > /tmp/lua_*")
)
) or
(
process.parent.name == "apache2" and (
process.command_line in (
"sh -c /usr/local/bin/php -r 'echo phpversion();'", "sh -c -- /usr/local/bin/php -r 'echo phpversion();'",
"sh -c /usr/bin/php -r 'echo phpversion();'",
"sh -c /usr/bin/lsb_release -a 2>/dev/null",
"sh -c /usr/bin/crontab -l;",
"sh -c -- whoami",
"sh -c /usr/bin/crontab -l 2>/dev/null",
"sh -c /usr/bin/crontab -",
"sh -c lsb_release --all </dev/null 2>/dev/null",
"sh -c /usr/bin/lsb_release -ds | cut -d= -f2 | tr -d '\"'"
) or
process.args like (
"""bash -c "( /home/*/apps/richdocumentscode/collabora/Collabora_Online.AppImage*""",
"chmod 777 /etc/cobra/uploads/mysql*", "stat*"
) or
process.command_line like (
"*/usr/bin/crontab*phpupdatecrontab.txt", "*mysqldump*/var/www/html/*/writable/uploads/backup/mysql*",
"sh -c chmod 777 -R /opt/data/www/php_upload/*/temp", "sh -c chmod 777 -R /opt/data/www/php_upload/*/sync/*"
)
)
) or
(
process.parent.name like "php-fpm*" and (
process.command_line in (
"sh -c /usr/bin/php -r 'echo phpversion();'", "sh -c -- /usr/bin/php -r 'echo phpversion();'",
"sh -c php -r 'print_r(phpversion());'", "sh -c chattr -i -a /usr/local/virtualizor/license2.php",
"sh -c -- netstat -ie 2>&1",
"sh -c hostname",
"sh -c source /etc/os-release 2>/dev/null && echo $ID $ID_LIKE",
"sh -c netstat -ie 2>&1",
"sh -c php -r \"echo date('T');\"",
"sh -c php -r \"echo PHP_VERSION;\"",
"sh -c -- php -r \"echo (int)function_exists('pcntl_signal');\"",
"sh -c -- php -r \"echo PHP_VERSION;\"",
"sh -c -- php -r \"echo date('T');\"",
"sh -c /usr/bin/lsb_release -a 2>/dev/null"
) or
process.command_line like (
"*var_export*extension_loaded*", "*/tmp/tmp_resize*", "*/v1/objects/hosts/*_Infoterminal*", "*python -m json.tool*",
"sh -c timeout 3600 ssh -o ControlMaster=auto -o ControlPath=/var/www/html/storage/app/ssh/mux/*",
"sh -c -- chmod 777 *.XML", "sh -c /usr/bin/lsb_release -a 2>/dev/null"
) or
process.args like ("ps*|*grep*", "ffmpeg*", "chmod*777*.xml")
)
) or
(
process.parent.name == "php-cgi" and (
process.command_line like (
"sh -c nohup php /home/*/public_html/lockindex.php index.php >/dev/null 2>&1 &",
"sh -c nohup php /home/*/public_html/wp-content/* >> /dev/null 2>&1 &",
"sh -c nohup php /home/*/public_html/wp-includes/* >> /dev/null 2>&1 &",
"sh -c nohup php /home/*/public_html/*/wp-content/* >> /dev/null 2>&1 &",
"*-ef|grep*",
"sh -c /usr/bin/php -r 'echo phpversion();'"
) or
process.args like "ps*| grep*"
)
) or
(
process.parent.name == "java" and process.command_line == "/usr/bin/env sh -c ldd /usr/bin/env | grep -q musl"
) or
(
process.command_line == "/bin/sh -c echo | openssl s_client -connect localhost:61617 2>/dev/null | openssl x509 -noout -enddate" and
process.parent.name == "gunicorn"
) or
(
process.parent.executable == "/usr/local/bin/gunicorn" and
process.command_line == "/bin/sh -c echo 'Q' | openssl s_client -connect localhost:61617 2>/dev/null | openssl x509 -noout -enddate"
) or
(
process.parent.executable like "/home/rails/.rbenv/versions/*/bin/ruby" and
process.command_line == "sh -c crontab -l 2> /dev/null"
) or
(
process.parent.executable == "/opt/bitnami/apache/bin/httpd" and
process.command_line == "sh -c /opt/bitnami/php/bin/php -r 'echo phpversion();'"
) or
(
process.parent.executable like "/var/lib/containers/storage/overlay/*/merged/usr/local/sbin/php-fpm" and
process.command_line == "sh -c /usr/local/bin/php -r 'echo phpversion();'"
) or
(
process.parent.executable like "/var/lib/docker/overlay2/*/merged/usr/sbin/uwsgi" and
process.command_line == "/bin/sh -c { touch /run/uwsgi-logrotate }"
) or
(process.parent.executable == "/var/www/cgi-bin/vtsystem.cgi" and process.command_line == "sh -c hostname") or
(process.parent.name like "python*" and process.parent.command_line like "*hive_server.py*") or
(process.parent.name == "sw-engine-fpm" and process.command_line like ("*/opt/psa/admin/bin/*", "*/usr/local/psa/admin/*")) or
(
process.parent.name == "httpd" and
process.command_line like (
"*/datastore/htdocs/control-states/compass*", "*/dev/shm/netmon-log*", "sh -c /usr/bin/crontab -l 2>/dev/null",
"sh -c /usr/bin/crontab -"
)
) or
(process.parent.name == "asterisk" and process.args like "/bin/chmod 777 */gravacoes/*.WAV") or
(process.parent.name == "varnishd" and process.args like "exec gcc*") or
(process.parent.name in ("apache2", "php-cgi") and process.command_line in ("sh -c crontab -l", "sh -c -- crontab -l")) or
(process.parent.name in ("php-fpm", "httpd") and process.command_line in (
"sh -c whoami", "sh -c /usr/bin/php -r 'echo phpversion();'",
"sh -c TERM=dumb cat /var/run/elasticsearch/elasticsearch.pid", "sh -c TERM=dumb cat /var/run/logstash/logstash.pid"
)) or
(process.parent.name == "zabbix_server" and process.command_line like "*/usr/sbin/sendmail*") or
(process.parent.executable == "/opt/morpheus/embedded/java/jre/bin/java" and process.command_line like "*morpheus-local*") or
(
process.parent.name == "ruby" and
process.command_line in (
"sh -c cat /etc/hostname 2>/dev/null",
"sh -c echo \"^d\" | openssl s_client -connect 127.0.0.1:443 2>&1",
"sh -c cat /etc/hosts.allow 2>/dev/null"
)
) or
(process.parent.name == "java" and process.args like "chmod 777 *.csv") or
process.command_line == "sh -c node -v || nodejs -v" or
process.working_directory == "/var/lib/puppet/rack/puppetmasterd" or
(process.working_directory == "/olympe" and process.parent.executable == "/usr/local/bin/ruby" and process.command_line == "sh -c ssh-keygen -f ~/.ssh/id_ed25519 -y") or
(process.parent.name like "python*" and process.parent.args == "/root/.local/share/uv/tools/mini-swe-agent/bin/python") or
(process.parent.executable == "/usr/sbin/zabbix_server" and process.command_line like "*/usr/lib/zabbix/alertscripts/sms_gw*")
)