Web Server Spawned Shell

rule: Web Server Spawned Shell
desc: 'Detects a web server process (nginx, apache, php-fpm, etc.) spawning an interactive
  shell. This is a strong indicator of webshell exploitation or remote code execution
  vulnerability being actively exploited. Webshells are a common persistence mechanism
  used by attackers after compromising web applications. The macro user_known_web_server_shell_activities
  can be overridden to tune for legitimate use cases like CGI scripts. Note that simple
  shell wrappers used in health checks are excluded.

  '
condition: 'spawned_process and spawned_by_web_server and proc.name in (shell_binaries)
  and not proc.cmdline startswith "sh -c /usr/bin" and not proc.cmdline contains "healthcheck"
  and not user_known_web_server_shell_activities

  '
output: Web server spawned shell | shell=%proc.name web_server=%proc.pname gparent=%proc.aname[2]
  ggparent=%proc.aname[3] evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid
  command=%proc.cmdline terminal=%proc.tty exe=%proc.exepath exe_flags=%evt.arg.flags
priority: CRITICAL
tags:
- maturity_sandbox
- host
- container
- process
- mitre_persistence
- mitre_execution
- T1505.003