Detects webshell using cookie POST

Hunt Hypothesis

This detection identifies potential webshell activity by flagging anomalous HTTP POST requests that utilize cookies as a covert channel for command execution and data exfiltration. SOC teams should proactively hunt for this behavior in Azure Sentinel to uncover stealthy post-compromise persistence mechanisms that often evade standard signature-based defenses due to their reliance on legitimate web traffic patterns.

YARA Rule

rule WEBSHELL_Cookie_Post_Obfuscation {
    meta:
        description = "Detects webshell using cookie POST"
        author = "Arnim Rupp (https://github.com/ruppde)"
        reference = "Internal Research"
        score = 75
        date = "2023-01-28"
        modified = "2023-04-05"
        license = "https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md"
        hash = "d08a00e56feb78b7f6599bad6b9b1d8626ce9a6ea1dfdc038358f4c74e6f65c9"
        hash = "2ce5c4d31682a5a59b665905a6f698c280451117e4aa3aee11523472688edb31"
        hash = "ff732d91a93dfd1612aed24bbb4d13edb0ab224d874f622943aaeeed4356c662"
        hash = "a3b64e9e065602d2863fcab641c75f5d8ec67c8632db0f78ca33ded0f4cea257"
        hash = "d41abce305b0dc9bd3a9feb0b6b35e8e39db9e75efb055d0b1205a9f0c89128e"
        hash = "333560bdc876fb0186fae97a58c27dd68123be875d510f46098fc5a61615f124"
        hash = "2efdb79cdde9396ff3dd567db8876607577718db692adf641f595626ef64d3a4"
        hash = "e1bd3be0cf525a0d61bf8c18e3ffaf3330c1c27c861aede486fd0f1b6930f69a"
        hash = "f8cdedd21b2cc29497896ec5b6e5863cd67cc1a798d929fd32cdbb654a69168a"

        id = "cc5ded80-5e58-5b25-86d1-1c492042c740"
    strings:
        $s1 = "]($_COOKIE, $_POST) as $"
        $s2 = "function"
        $s3 = "Array"
    condition:
    ( uint16(0) == 0x3f3c and filesize < 100KB and ( all of them ))
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• Internal Research
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects webshell using cookie POST” rule, including suggested filters and exclusions:

• Scenario: Automated Monitoring & Health Checks

  • Context: Enterprise monitoring tools like SolarWinds NPM, Datadog, or New Relic frequently send POST requests to application endpoints to verify uptime. These agents often embed a unique session identifier in the Cookie header and may include a small JSON payload that mimics webshell command execution patterns.
  • Suggested Filter/Exclusion: Create an exclusion rule based on known monitoring IP ranges (e.g., Source_IP IN [10.20.5.0/24]) or filter out requests where the User-Agent string matches specific monitoring tools (e.g., User-Agent CONTAINS "SolarWinds").

• Scenario: Scheduled ETL and Data Synchronization Jobs

  • Context: Internal Azure Data Factory, Talend, or custom Python scripts running on a nightly schedule often perform data ingestion via API endpoints. These jobs utilize persistent sessions (stored in cookies) to maintain state during POST operations for bulk record updates, which can trigger the webshell detection logic due to the presence of large cookie headers combined with POST methods.
  • Suggested Filter/Exclusion: Exclude traffic occurring during specific maintenance windows (e.g., Time BETWEEN 02:00 AND 04:00) for known service accounts or filter by specific API endpoint paths that are dedicated to data ingestion (e.g., URI_PATH STARTS "/api/v1/sync").

• Scenario: Single Sign-On (SSO) and Identity Federation

  • Context: During user authentication flows using Okta, Azure Active Directory (Entra ID), or Keycloak, the