Corelight - Possible Webshell Rare PUT or POST

Back


Id	db662e49-6e34-4d10-9d3c-5d04b5479658
Rulename	Corelight - Possible Webshell (Rare PUT or POST)
Description	Detects rare post requests to a single webserver location.
Severity	Medium
Tactics	Persistence
Techniques	T1505
Required data connectors	Corelight
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Corelight/Analytic Rules/CorelightPossibleWebshellRarePOST.yaml
Version	2.1.0
Arm template	db662e49-6e34-4d10-9d3c-5d04b5479658.json

KQL

let threshold = 3;
corelight_http
| where method in~ ('POST', 'PUT')
| where toint(status_code) !between (400 .. 499)
| where request_body_len != 0 or response_body_len != 0
| extend fe = extract(@'.*(\.\w+)$', 1, uri)
| where fe in~ ('.aspx', '.asp', '.php', '.jsp', '.jspx', '.war', '.ashx', '.asmx', '.ascx', '.asx', '.cshtml', '.cfm', '.cfc', '.cfml', '.wss', '.do', '.action', '.pl', '.plx', '.pm', '.xs', '.t', '.pod', '.php-s', '.pht', '.phar', '.phps', '.php7', '.php5', '.php4', '.php3', '.phtml', '.py', '.rb', '.rhtml', '.cgi', '.dll', '.ayws', '.cgi', '.erb', '.rjs', '.hta', '.htc', '.cs', '.kt', '.lua', '.vbhtml')
| summarize count() by uri, id_orig_h
| where count_ < threshold

YAML

relevantTechniques:
- T1505
name: Corelight - Possible Webshell (Rare PUT or POST)
requiredDataConnectors:
- dataTypes:
  - Corelight_v2_http
  - corelight_http
  connectorId: Corelight
entityMappings:
- fieldMappings:
  - identifier: Address
    columnName: id_orig_h
  entityType: IP
triggerThreshold: 0
id: db662e49-6e34-4d10-9d3c-5d04b5479658
tactics:
- Persistence
version: 2.1.0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Corelight/Analytic Rules/CorelightPossibleWebshellRarePOST.yaml
queryPeriod: 1h
kind: Scheduled
queryFrequency: 1h
severity: Medium
status: Available
description: |
    'Detects rare post requests to a single webserver location.'
query: |
  let threshold = 3;
  corelight_http
  | where method in~ ('POST', 'PUT')
  | where toint(status_code) !between (400 .. 499)
  | where request_body_len != 0 or response_body_len != 0
  | extend fe = extract(@'.*(\.\w+)$', 1, uri)
  | where fe in~ ('.aspx', '.asp', '.php', '.jsp', '.jspx', '.war', '.ashx', '.asmx', '.ascx', '.asx', '.cshtml', '.cfm', '.cfc', '.cfml', '.wss', '.do', '.action', '.pl', '.plx', '.pm', '.xs', '.t', '.pod', '.php-s', '.pht', '.phar', '.phps', '.php7', '.php5', '.php4', '.php3', '.phtml', '.py', '.rb', '.rhtml', '.cgi', '.dll', '.ayws', '.cgi', '.erb', '.rjs', '.hta', '.htc', '.cs', '.kt', '.lua', '.vbhtml')
  | summarize count() by uri, id_orig_h
  | where count_ < threshold  
triggerOperator: gt

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/db662e49-6e34-4d10-9d3c-5d04b5479658')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/db662e49-6e34-4d10-9d3c-5d04b5479658')]",
      "properties": {
        "alertRuleTemplateName": "db662e49-6e34-4d10-9d3c-5d04b5479658",
        "customDetails": null,
        "description": "'Detects rare post requests to a single webserver location.'\n",
        "displayName": "Corelight - Possible Webshell (Rare PUT or POST)",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "id_orig_h",
                "identifier": "Address"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Corelight/Analytic Rules/CorelightPossibleWebshellRarePOST.yaml",
        "query": "let threshold = 3;\ncorelight_http\n| where method in~ ('POST', 'PUT')\n| where toint(status_code) !between (400 .. 499)\n| where request_body_len != 0 or response_body_len != 0\n| extend fe = extract(@'.*(\\.\\w+)$', 1, uri)\n| where fe in~ ('.aspx', '.asp', '.php', '.jsp', '.jspx', '.war', '.ashx', '.asmx', '.ascx', '.asx', '.cshtml', '.cfm', '.cfc', '.cfml', '.wss', '.do', '.action', '.pl', '.plx', '.pm', '.xs', '.t', '.pod', '.php-s', '.pht', '.phar', '.phps', '.php7', '.php5', '.php4', '.php3', '.phtml', '.py', '.rb', '.rhtml', '.cgi', '.dll', '.ayws', '.cgi', '.erb', '.rjs', '.hta', '.htc', '.cs', '.kt', '.lua', '.vbhtml')\n| summarize count() by uri, id_orig_h\n| where count_ < threshold\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Persistence"
        ],
        "techniques": [
          "T1505"
        ],
        "templateVersion": "2.1.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}