Corelight - Possible Webshell Rare PUT or POST

Back


Id	db662e49-6e34-4d10-9d3c-5d04b5479658
Rulename	Corelight - Possible Webshell (Rare PUT or POST)
Description	Detects rare post requests to a single webserver location.
Severity	Medium
Tactics	Persistence
Techniques	T1505
Required data connectors	Corelight
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Corelight/Analytic Rules/CorelightPossibleWebshellRarePOST.yaml
Version	2.1.0
Arm template	db662e49-6e34-4d10-9d3c-5d04b5479658.json

KQL

let threshold = 3;
corelight_http
| where method in~ ('POST', 'PUT')
| where toint(status_code) !between (400 .. 499)
| where request_body_len != 0 or response_body_len != 0
| extend fe = extract(@'.*(\.\w+)$', 1, uri)
| where fe in~ ('.aspx', '.asp', '.php', '.jsp', '.jspx', '.war', '.ashx', '.asmx', '.ascx', '.asx', '.cshtml', '.cfm', '.cfc', '.cfml', '.wss', '.do', '.action', '.pl', '.plx', '.pm', '.xs', '.t', '.pod', '.php-s', '.pht', '.phar', '.phps', '.php7', '.php5', '.php4', '.php3', '.phtml', '.py', '.rb', '.rhtml', '.cgi', '.dll', '.ayws', '.cgi', '.erb', '.rjs', '.hta', '.htc', '.cs', '.kt', '.lua', '.vbhtml')
| summarize count() by uri, id_orig_h
| where count_ < threshold

YAML

queryPeriod: 1h
query: |
  let threshold = 3;
  corelight_http
  | where method in~ ('POST', 'PUT')
  | where toint(status_code) !between (400 .. 499)
  | where request_body_len != 0 or response_body_len != 0
  | extend fe = extract(@'.*(\.\w+)$', 1, uri)
  | where fe in~ ('.aspx', '.asp', '.php', '.jsp', '.jspx', '.war', '.ashx', '.asmx', '.ascx', '.asx', '.cshtml', '.cfm', '.cfc', '.cfml', '.wss', '.do', '.action', '.pl', '.plx', '.pm', '.xs', '.t', '.pod', '.php-s', '.pht', '.phar', '.phps', '.php7', '.php5', '.php4', '.php3', '.phtml', '.py', '.rb', '.rhtml', '.cgi', '.dll', '.ayws', '.cgi', '.erb', '.rjs', '.hta', '.htc', '.cs', '.kt', '.lua', '.vbhtml')
  | summarize count() by uri, id_orig_h
  | where count_ < threshold  
name: Corelight - Possible Webshell (Rare PUT or POST)
entityMappings:
- fieldMappings:
  - columnName: id_orig_h
    identifier: Address
  entityType: IP
queryFrequency: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Corelight/Analytic Rules/CorelightPossibleWebshellRarePOST.yaml
requiredDataConnectors:
- connectorId: Corelight
  dataTypes:
  - Corelight_v2_http
  - corelight_http
description: |
    'Detects rare post requests to a single webserver location.'
kind: Scheduled
version: 2.1.0
status: Available
severity: Medium
relevantTechniques:
- T1505
triggerOperator: gt
triggerThreshold: 0
tactics:
- Persistence
id: db662e49-6e34-4d10-9d3c-5d04b5479658

ARM