Query: write Sigma for Detects certain command line parameters often used during reconnaissance activity via web shells
Matching passage: Sigma rule: Detects certain command line parameters often used during reconnaissance activity via web shells. Logsource: windows / process_creation. Rule: title: Webshell Detection With Command Line Keywords id: bed2a484-9348-4143-8a8a-b801c979301c status: test description: Detects certain command line parameters often used during reconnaissance activity via web shells references: - https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-ii.html - https://unit42.paloaltonetworks.com/bumblebee-webshell-xhunt-campaign/ - https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson date: 2017-01-01 modified: 2026-07-14 tags: - attack.persistence - attack.discovery - attack.t1505.003 - attack.t1018 - attack.t1033 - attack.t1087 logsource: category: process_creation product: windows detection: selection_webserver_image: ParentImage|endswith: - \w3wp.exe - \php-cgi.exe - \nginx.exe - \httpd.exe - \caddy.exe - \ws_tomcatservice.exe selection_webserver_characteristics_tomcat1: ParentImage|endswith: - \java.exe - \javaw.exe ParentImage|contains: - -tomcat- - \tomcat selection_webserver_characteristics_tomcat2: ParentImage|endswith: - \java.exe - \javaw.exe CommandLine|contains: - catalina.jar - CATALINA_HOME selection_susp_net_utility: OriginalFileName: - net.exe - net1.exe CommandLine|contains: - ' user ' - ' use ' - ' group ' selection_susp_ping_utility: OriginalFileName: ping.exe CommandLine|contains: ' -n ' selection_susp_change_dir: CommandLine|contains: - '&cd&echo' - 'cd /d ' selection_susp_wmic_utility: OriginalFileName: wmic.exe CommandLine|contains: ' /node:' selection_susp_powershell_cli: Image|endswith: - \cmd.exe - \powershell.exe - \pwsh.exe CommandLine|contains: - ' -enc ' - ' -EncodedCommand ' - ' -w hidden ' - ' -windowstyle hidden' - .WebClient).Download selection_susp_misc_discovery_binaries: - Image|endswith: - \dsquery.exe - \find.exe - \findstr.exe - \ipconfig.exe - \netstat.exe - \nslookup.exe - \pathping.exe - \quser.exe - \schtasks.exe - \systeminfo.exe - \tasklist.exe - \tracert.exe - \wevtutil.exe - \whoami.exe - OriginalFileName: - dsquery.exe - find.exe - findstr.exe - ipconfig.exe - netstat.exe - nslookup.exe - pathping.exe - quser.exe - schtasks.exe - sysinfo.exe - tasklist.exe - tracert.exe - VSSADMIN.EXE - wevtutil.exe - whoami.exe selection_susp_misc_discovery_commands: CommandLine|contains: - ' Test-NetConnection ' - dir \ condition: 1 of selection_webserver_* and 1 of selectio
Near-miss passage: Sigma rule: Detects deletion attempts of MacOS Time Machine backups via the native backup utility "tmutil". An adversary may perform. Logsource: macos / process_creation. Rule: title: Time Machine Backup Deletion Attempt Via Tmutil - MacOS id: 452df256-da78-427a-866f-49fa04417d74 status: test description: 'Detects deletion attempts of MacOS Time Machine backups via the native backup utility "tmutil". An adversary may perform this action before launching a ransonware attack to prevent the victim from restoring their files. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-12---disable-time-machine - https://www.loobins.io/binaries/tmutil/ author: Pratinav Chandra date: 2024-05-29 tags: - attack.impact - attack.t1490 logsource: category: process_creation product: macos detection: selection_img: - Image|endswith: /tmutil - CommandLine|contains: tmutil selection_cmd: CommandLine|contains: delete condition: all of selection_* falsepositives: - Legitimate activities level: medium