Webshell Detection With Command Line Keywords

{
  "selection_webserver_image": {
    "ParentImage
| endswith": [
      "\\w3wp.exe",
      "\\php-cgi.exe",
      "\\nginx.exe",
      "\\httpd.exe",
      "\\caddy.exe",
      "\\ws_tomcatservice.exe"
    ]
  },
  "selection_webserver_characteristics_tomcat1": {
    "ParentImage
| endswith": [
      "\\java.exe",
      "\\javaw.exe"
    ],
    "ParentImage
| contains": [
      "-tomcat-",
      "\\tomcat"
    ]
  },
  "selection_webserver_characteristics_tomcat2": {
    "ParentImage
| endswith": [
      "\\java.exe",
      "\\javaw.exe"
    ],
    "CommandLine
| contains": [
      "catalina.jar",
      "CATALINA_HOME"
    ]
  },
  "selection_susp_net_utility": {
    "OriginalFileName": [
      "net.exe",
      "net1.exe"
    ],
    "CommandLine
| contains": [
      " user ",
      " use ",
      " group "
    ]
  },
  "selection_susp_ping_utility": {
    "OriginalFileName": "ping.exe",
    "CommandLine
| contains": " -n "
  },
  "selection_susp_change_dir": {
    "CommandLine
| contains": [
      "&cd&echo",
      "cd /d "
    ]
  },
  "selection_susp_wmic_utility": {
    "OriginalFileName": "wmic.exe",
    "CommandLine
| contains": " /node:"
  },
  "selection_susp_powershell_cli": {
    "Image
| endswith": [
      "\\cmd.exe",
      "\\powershell.exe",
      "\\pwsh.exe"
    ],
    "CommandLine
| contains": [
      " -enc ",
      " -EncodedCommand ",
      " -w hidden ",
      " -windowstyle hidden",
      ".WebClient).Download"
    ]
  },
  "selection_susp_misc_discovery_binaries": [
    {
      "Image
| endswith": [
        "\\dsquery.exe",
        "\\find.exe",
        "\\findstr.exe",
        "\\ipconfig.exe",
        "\\netstat.exe",
        "\\nslookup.exe",
        "\\pathping.exe",
        "\\quser.exe",
        "\\schtasks.exe",
        "\\systeminfo.exe",
        "\\tasklist.exe",
        "\\tracert.exe",
        "\\wevtutil.exe",
        "\\whoami.exe"
      ]
    },
    {
      "OriginalFileName": [
        "dsquery.exe",
        "find.exe",
        "findstr.exe",
        "ipconfig.exe",
        "netstat.exe",
        "nslookup.exe",
        "pathping.exe",
        "quser.exe",
        "schtasks.exe",
        "sysinfo.exe",
        "tasklist.exe",
        "tracert.exe",
        "VSSADMIN.EXE",
        "wevtutil.exe",
        "whoami.exe"
      ]
    }
  ],
  "selection_susp_misc_discovery_commands": {
    "CommandLine
| contains": [
      " Test-NetConnection ",
      "dir \\"
    ]
  },
  "condition": "1 of selection_webserver_* and 1 of selection_susp_*"
}

False Positives

• ⚠ Unknown