Sigma rule: Linux Webshell Indicators

Rule

Title

Linux Webshell Indicators

Status

test

Level

high

Author

Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

Date

2021-10-15

Modified

2026-08-19

File

rules/linux/process_creation/proc_creation_lnx_webshell_detection.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects suspicious sub processes of web server processes

Log source

product

linux

category

process_creation

Detection

selection_parent_general:
    ParentImage|endswith:
        - '/httpd'
        - '/lighttpd'
        - '/nginx'
        - '/apache2'
        - '/node'
        - '/caddy'
selection_parent_tomcat:
    ParentCommandLine|contains|all:
        - '/bin/java'
        - 'tomcat'
selection_parent_websphere:  # ? just guessing
    ParentCommandLine|contains|all:
        - '/bin/java'
        - 'websphere'
selection_child_processes:
    Image|endswith:
        - '/whoami'
        - '/ifconfig'
        - '/ip'
        - '/bin/uname'
        - '/bin/cat'
        - '/bin/crontab'
        - '/hostname'
        - '/iptables'
        - '/netstat'
        - '/pwd'
        - '/route'
filter_optional_ip_neigh:
    ParentImage|endswith: '/node'
    CommandLine|contains: 'ip neigh show'
condition: 1 of selection_parent_* and selection_child_processes and not 1 of filter_optional_*

False positives (as the rule lists them)

• Web applications that invoke Linux command line tools

Tags

• attack.persistence
• attack.t1505.003

MITRE ATT&CK ids this rule names

• T1505.003

References

• https://www.acunetix.com/blog/articles/web-shells-101-using-php-introduction-web-shells-part-2/
• https://media.defense.gov/2020/Jun/09/2002313081/-1/-1/0/CSI-DETECT-AND-PREVENT-WEB-SHELL-MALWARE-20200422.PDF

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/linux/process_creation/proc_creation_lnx_webshell_detection.yml