Sigma rule: Windows Webshell Strings

Rule

Title

Windows Webshell Strings

Status

test

Level

high

Author

Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

Date

2017-02-19

Modified

2022-11-18

File

rules/web/webserver_generic/web_win_webshells_in_access_logs.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects common commands used in Windows webshells

Log source

category

webserver

Detection

selection_method:
    cs-method: 'GET'
selection_keywords:
    # The "%20" is URL encoded version of the space
    # The "%2B" is URL encoded version of the "+"
    - '=whoami'
    - '=net%20user'
    - '=net+user'
    - '=net%2Buser'
    - '=cmd%20/c%'
    - '=cmd+/c+'
    - '=cmd%2B/c%'
    - '=cmd%20/r%'
    - '=cmd+/r+'
    - '=cmd%2B/r%'
    - '=cmd%20/k%'
    - '=cmd+/k+'
    - '=cmd%2B/k%'
    - '=powershell%'
    - '=powershell+'
    - '=tasklist%'
    - '=tasklist+'
    - '=wmic%'
    - '=wmic+'
    - '=ssh%'
    - '=ssh+'
    - '=python%'
    - '=python+'
    - '=python3%'
    - '=python3+'
    - '=ipconfig'
    - '=wget%'
    - '=wget+'
    - '=curl%'
    - '=curl+'
    - '=certutil'
    - '=copy%20%5C%5C'
    - '=dsquery%'
    - '=dsquery+'
    - '=nltest%'
    - '=nltest+'
condition: all of selection_*

False positives (as the rule lists them)

• Web sites like wikis with articles on os commands and pages that include the os commands in the URLs
• User searches in search boxes of the respective website

Tags

• attack.persistence
• attack.t1505.003

MITRE ATT&CK ids this rule names

• T1505.003

References

• https://bad-jubies.github.io/RCE-NOW-WHAT/
• https://m365internals.com/2022/10/07/hunting-in-on-premises-exchange-server-logs/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/web/webserver_generic/web_win_webshells_in_access_logs.yml