- title: Webshell Detection by Keyword
id: 7ff9db12-1b94-4a79-ba68-a2402c5d6729
description: Detects webshells that use GET requests by keyword searches in URL
strings
author: Florian Roth
logsource:
category: webserver
product: null
service: null
detection:
keywords:
- =whoami
- =net%20user
- =cmd%20/c%20
condition: keywords
fields:
- client_ip
- vhost
- url
- response
falsepositives:
- Web sites like wikis with articles on os commands and pages that include the os
commands in the URLs
- User searches in search boxes of the respective website
level: high
In [ ]:
from elasticsearch import Elasticsearch
from elasticsearch_dsl import Search
import pandas as pd
In [ ]:
es = Elasticsearch(['http://helk-elasticsearch:9200'])
searchContext = Search(using=es, index='logs-*', doc_type='doc')
In [ ]:
s = searchContext.query('query_string', query='\*.keyword:(*\=whoami* OR *\=net%20user* OR *\=cmd%20\/c%20*)')
response = s.execute()
if response.success():
df = pd.DataFrame((d.to_dict() for d in s.scan()))
In [ ]:
df.head()