Webserver Access to Webshell in WebLogic Keystore Folder

title: Webserver Access to Webshell in WebLogic Keystore Folder
id: 6188175d-7bfd-4cd2-a9d4-5c8e6ff1831d
status: test
description: Detects HTTP requests whose query string matches a pattern consistent with a webshell placed under a WebLogic server keystore directory (*/config/keystore/*.js*). Attackers may use this type of dropped script to maintain persistence and execute server-side actions through subsequent web requests. The rule relies on webserver request telemetry that includes the full URI query string (cs-uri-query).
references:
  - https://twitter.com/pyn3rd/status/1020620932967223296
  - https://github.com/LandGrey/CVE-2018-2894
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2018/Exploits/CVE-2018-2894/web_cve_2018_2894_weblogic_exploit.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2018-07-22
modified: 2023-01-02
tags:
  - attack.t1190
  - attack.initial-access
  - attack.persistence
  - attack.t1505.003
  - cve.2018-2894
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query: "*/config/keystore/*.js*"
  condition: selection
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 37e8369b-43bb-4bf8-83b6-6dd43bda2000
    type: derived