Query: write Sigma for Detects a highly relevant Antivirus alert that reports a web shell. It's highly recommended to tune this rule to the spe
Matching passage: Sigma rule: Detects a highly relevant Antivirus alert that reports a web shell. It's highly recommended to tune this rule to the spe. Logsource: antivirus. Rule: title: Antivirus - Web Shell Detection Signature id: fdf135a2-9241-4f96-a114-bb404948f736 status: test description: 'Detects a highly relevant Antivirus alert that reports a web shell. It''s highly recommended to tune this rule to the specific strings used by your anti virus solution by downloading a big WebShell repository from e.g. github and checking the matches. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place. ' references: - https://www.nextron-systems.com/?s=antivirus - https://github.com/tennc/webshell - https://www.virustotal.com/gui/file/bd1d52289203866645e556e2766a21d2275877fbafa056a76fe0cf884b7f8819/detection - https://www.virustotal.com/gui/file/308487ed28a3d9abc1fec7ebc812d4b5c07ab025037535421f64c60d3887a3e8/detection - https://www.virustotal.com/gui/file/7d3cb8a8ff28f82b07f382789247329ad2d7782a72dde9867941f13266310c80/detection - https://www.virustotal.com/gui/file/e841675a4b82250c75273ebf0861245f80c6a1c3d5803c2d995d9d3b18d5c4b5/detection - https://www.virustotal.com/gui/file/a80042c61a0372eaa0c2c1e831adf0d13ef09feaf71d1d20b216156269045801/detection - https://www.virustotal.com/gui/file/b219f7d3c26f8bad7e175934cd5eda4ddb5e3983503e94ff07d39c0666821b7e/detection - https://www.virustotal.com/gui/file/b8702acf32fd651af9f809ed42d15135f842788cd98d81a8e1b154ee2a2b76a2/detection - https://www.virustotal.com/gui/file/13ae8bfbc02254b389ab052aba5e1ba169b16a399d9bc4cb7414c4a73cd7dc78/detection author: Florian Roth (Nextron Systems), Arnim Rupp date: 2018-09-09 modified: 2026-06-29 tags: - attack.persistence - attack.t1505.003 logsource: category: antivirus detection: selection: - Signature|startswith: - ASP. - IIS/BackDoor - JAVA/Backdoor - JSP. - Perl. - PHP. - Troj/ASP - Troj/JSP - Troj/PHP - VBS/Uxor - Signature|contains: - ASP_ - 'ASP:' - ASP.Agent - ASP/ - Aspdoor - ASPXSpy - Backdoor.ASP - Backdoor.Java - Backdoor.JSP - Backdoor.PHP - Backdoor.VBS - Backdoor/ASP - Backdoor/Java - Backdoor/JSP - Backdoor/PHP - Backdoor/VBS - C99shell - Chopper - filebrowser - JSP_ - 'JSP:' - JSP.Agent - JSP/ - 'Perl:' - Perl/ - PHP_ - 'PHP:' - PHP.Agent - PHP/ - PHPShell - PShlSpy - SinoChoper - Trojan.ASP - Trojan.JSP - Trojan.PHP - Trojan.VBS - VBS.Agent - VBS/Agent - Webshell condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects using Rasautou.exe for loading arbitrary .DLL specified in -d option and executes the export specified in -p.. Logsource: windows / process_creation. Rule: title: DLL Execution via Rasautou.exe id: cd3d1298-eb3b-476c-ac67-12847de55813 status: test description: Detects using Rasautou.exe for loading arbitrary .DLL specified in -d option and executes the export specified in -p. references: - https://lolbas-project.github.io/lolbas/Binaries/Rasautou/ - https://github.com/fireeye/DueDLLigence - https://www.fireeye.com/blog/threat-research/2019/10/staying-hidden-on-the-endpoint-evading-detection-with-shellcode.html author: Julia Fomina, oscd.community date: 2020-10-09 tags: - attack.stealth - attack.t1218 logsource: product: windows category: process_creation definition: Since options '-d' and '-p' were removed in Windows 10 this rule is relevant only for Windows before 10. And as Windows 7 doesn't log command line in 4688 by default, to detect this attack you need Sysmon 1 configured or KB3004375 installed for command-line auditing (https://support.microsoft.com/en-au/help/3004375/microsoft-security-advisory-update-to-improve-windows-command-line-aud) detection: selection_img: - Image|endswith: \rasautou.exe - OriginalFileName: rasdlui.exe selection_cli: CommandLine|contains|all: - ' -d ' - ' -p ' condition: all of selection* falsepositives: - Unlikely level: medium