Sigma rule: Webshell ReGeorg Detection Via Web Logs

Rule

Title

Webshell ReGeorg Detection Via Web Logs

Status

test

Level

high

Author

Cian Heasley

Date

2020-08-04

Modified

2023-01-02

File

rules/web/webserver_generic/web_webshell_regeorg.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Certain strings in the uri_query field when combined with null referer and null user agent can indicate activity associated with the webshell ReGeorg.

Log source

category

webserver

Detection

selection:
    cs-uri-query|contains:
        - 'cmd=read'
        - 'connect&target'
        - 'cmd=connect'
        - 'cmd=disconnect'
        - 'cmd=forward'
filter:
    cs-referer: null
    cs-user-agent: null
    cs-method: POST
condition: selection and filter

False positives (as the rule lists them)

• Web applications that use the same URL parameters as ReGeorg

Tags

• attack.persistence
• attack.t1505.003

MITRE ATT&CK ids this rule names

• T1505.003

References

• https://community.rsa.com/community/products/netwitness/blog/2019/02/19/web-shells-and-netwitness-part-3
• https://github.com/sensepost/reGeorg

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/web/webserver_generic/web_webshell_regeorg.yml