DEWMODE Webshell Access via URI Parameters (Webserver)

title: DEWMODE Webshell Access via URI Parameters (Webserver)
id: f96c6698-200a-49ef-a6a4-d6649145f14b
status: test
description: This rule flags web requests whose query string matches specific parameter patterns associated with DEWMODE webshell activity. Attackers may use webshells to maintain persistent remote access and execute arbitrary commands through the web server. The detection relies on webserver telemetry that records the requested URI query string and supports matching for the required parameter combinations.
references:
  - https://www.mandiant.com/resources/blog/accellion-fta-exploited-for-data-theft-and-extortion
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/TA/UNC2546/web_unc2546_dewmode_php_webshell.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-02-22
modified: 2023-01-02
tags:
  - attack.persistence
  - attack.t1505.003
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection1:
    cs-uri-query|contains|all:
      - ?dwn=
      - "&fn="
      - .html?
  selection2:
    cs-uri-query|contains|all:
      - "&dwn="
      - ?fn=
      - .html?
  condition: 1 of selection*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: fdf96c90-42d5-4406-8a9c-14a2c9a016b5
    type: derived