Query: Sigma rule for Detects a highly relevant Antivirus alert that reports a web shell. It's highly recommended to tune this rule to the spe
Matching passage: Sigma rule: Detects a highly relevant Antivirus alert that reports a web shell. It's highly recommended to tune this rule to the spe. Logsource: antivirus. Rule: title: Antivirus - Web Shell Detection Signature id: fdf135a2-9241-4f96-a114-bb404948f736 status: test description: 'Detects a highly relevant Antivirus alert that reports a web shell. It''s highly recommended to tune this rule to the specific strings used by your anti virus solution by downloading a big WebShell repository from e.g. github and checking the matches. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place. ' references: - https://www.nextron-systems.com/?s=antivirus - https://github.com/tennc/webshell - https://www.virustotal.com/gui/file/bd1d52289203866645e556e2766a21d2275877fbafa056a76fe0cf884b7f8819/detection - https://www.virustotal.com/gui/file/308487ed28a3d9abc1fec7ebc812d4b5c07ab025037535421f64c60d3887a3e8/detection - https://www.virustotal.com/gui/file/7d3cb8a8ff28f82b07f382789247329ad2d7782a72dde9867941f13266310c80/detection - https://www.virustotal.com/gui/file/e841675a4b82250c75273ebf0861245f80c6a1c3d5803c2d995d9d3b18d5c4b5/detection - https://www.virustotal.com/gui/file/a80042c61a0372eaa0c2c1e831adf0d13ef09feaf71d1d20b216156269045801/detection - https://www.virustotal.com/gui/file/b219f7d3c26f8bad7e175934cd5eda4ddb5e3983503e94ff07d39c0666821b7e/detection - https://www.virustotal.com/gui/file/b8702acf32fd651af9f809ed42d15135f842788cd98d81a8e1b154ee2a2b76a2/detection - https://www.virustotal.com/gui/file/13ae8bfbc02254b389ab052aba5e1ba169b16a399d9bc4cb7414c4a73cd7dc78/detection author: Florian Roth (Nextron Systems), Arnim Rupp date: 2018-09-09 modified: 2026-06-29 tags: - attack.persistence - attack.t1505.003 logsource: category: antivirus detection: selection: - Signature|startswith: - ASP. - IIS/BackDoor - JAVA/Backdoor - JSP. - Perl. - PHP. - Troj/ASP - Troj/JSP - Troj/PHP - VBS/Uxor - Signature|contains: - ASP_ - 'ASP:' - ASP.Agent - ASP/ - Aspdoor - ASPXSpy - Backdoor.ASP - Backdoor.Java - Backdoor.JSP - Backdoor.PHP - Backdoor.VBS - Backdoor/ASP - Backdoor/Java - Backdoor/JSP - Backdoor/PHP - Backdoor/VBS - C99shell - Chopper - filebrowser - JSP_ - 'JSP:' - JSP.Agent - JSP/ - 'Perl:' - Perl/ - PHP_ - 'PHP:' - PHP.Agent - PHP/ - PHPShell - PShlSpy - SinoChoper - Trojan.ASP - Trojan.JSP - Trojan.PHP - Trojan.VBS - VBS.Agent - VBS/Agent - Webshell condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the use of the Windows Update Client binary (wuauclt.exe) to proxy execute code and making network connections.. Logsource: windows / network_connection. Rule: title: Potentially Suspicious Wuauclt Network Connection id: c649a6c7-cd8c-4a78-9c04-000fc76df954 status: test description: 'Detects the use of the Windows Update Client binary (wuauclt.exe) to proxy execute code and making network connections. One could easily make the DLL spawn a new process and inject to it to proxy the network connection and bypass this rule. ' references: - https://dtm.uk/wuauclt/ author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-10-12 modified: 2024-03-12 tags: - attack.stealth - attack.t1218 logsource: category: network_connection product: windows definition: 'Requirements: The CommandLine field enrichment is required in order for this rule to be used.' detection: selection: Image|contains: wuauclt CommandLine|contains: ' /RunHandlerComServer' filter_main_ip: DestinationIp|cidr: - 127.0.0.0/8 - 10.0.0.0/8 - 169.254.0.0/16 - 172.16.0.0/12 - 192.168.0.0/16 - ::1/128 - fe80::/10 - fc00::/7 filter_main_msrange: DestinationIp|cidr: - 20.184.0.0/13 - 20.192.0.0/10 - 23.79.0.0/16 - 51.10.0.0/15 - 51.103.0.0/16 - 51.104.0.0/15 - 52.224.0.0/11 filter_main_uus: CommandLine|contains: - :\Windows\UUS\Packages\Preview\amd64\updatedeploy.dll /ClassId - :\Windows\UUS\amd64\UpdateDeploy.dll /ClassId filter_main_winsxs: CommandLine|contains|all: - :\Windows\WinSxS\ - '\UpdateDeploy.dll /ClassId ' filter_main_cli_null: CommandLine: null filter_main_cli_empty: CommandLine: '' condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium