Detects indicators related simple webshells that use the same exec/cmd pattern

Hunt Hypothesis

This detection rule identifies potential webshell compromises by isolating web server processes that execute commands using a consistent exec or cmd invocation pattern indicative of remote command execution. A proactive hunt is essential in Azure Sentinel to rapidly uncover these stealthy entry points before adversaries leverage them for lateral movement, data exfiltration, or persistent backdoor access within the cloud infrastructure.

YARA Rule

rule SUSP_WEBSHELL_LOG_Signatures_Dec25 {
   meta:
      description = "Detects indicators related simple webshells that use the same exec/cmd pattern"
      author = "Florian Roth"
      reference = "https://x.com/pyn3rd/status/1996840827897954542/photo/1"
      date = "2025-12-05"
      score = 60
      id = "8b97ba37-b503-5bcf-be94-76eec8b3d5cd"
   strings:
      $xa1 = "/exec?cmd=ls"
      $xa2 = "/exec?cmd=whoami"
      $xa3 = "/exec?cmd=id"
      $xa4 = "/exec?cmd=uname%20-a"
   condition:
      1 of them
      // not XML
      and not uint16(0) == 0x3c3f
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

False Positive Guidance

Here are 4 specific false positive scenarios for the “Simple Webshell Detection” rule, including suggested filters and exclusions:

Scheduled PowerShell Maintenance Scripts
- Scenario: Enterprise IT departments often deploy nightly maintenance scripts (e.g., using PowerShell.exe or cmd.exe) to clear temp folders, rotate logs, or update configurations. These scripts frequently invoke commands like powershell -command "Get-ChildItem..." or cmd /c del ..., which mimics the execution pattern of a simple webshell receiving remote instructions.
- Filter/Exclusion: Create an exclusion based on the User Account (e.g., DOMAIN\svc-maintenance) and File Path. Exclude alerts where the process path matches known script locations, such as C:\Scripts\Maintenance\ or D:\AdminTools\, provided the user is a dedicated service account rather than an interactive user.
CI/CD Pipeline Build Agents
- Scenario: Continuous Integration servers (e.g., Jenkins, Azure DevOps, GitLab Runners) running on build agents often execute shell commands to compile code or run unit tests. These agents frequently spawn cmd.exe or bash processes with long command lines containing flags like -c "npm install" or /c "dotnet test", which can trigger the webshell detection logic due to the high frequency of remote-like execution patterns.
- Filter/Exclusion: Implement a filter based on Process Name and Parent Process. Exclude events where the parent process is a known CI agent (e.g., java.exe for Jenkins, node.exe, or vstsagent) and the child process is cmd.exe or powershell.exe. Additionally, restrict this to specific IP ranges associated with the build farm.
Remote Administration via RDP/SSH Tools