Webserver Log Detection for Windows Webshell Command Strings in GET Parameters

Identifies GET requests with URL-encoded Windows command strings consistent with webshell behavior.

FreeUnreviewedSigmahighv1

webserver-log-detection-for-windows-webshell-command-strings-in-get-parameters-7ff9db12

title: Webserver Log Detection for Windows Webshell Command Strings in GET Parameters
id: f624636c-6f37-4c54-a539-4400ff8395c1
status: test
description: This rule flags webserver requests where the GET method includes specific URL-encoded command substrings commonly seen in Windows webshell activity. Attackers use these command patterns to execute or proxy system discovery and command execution via a web-accessible endpoint. It relies on webserver telemetry that captures the HTTP method and the raw request target/parameters containing the matched keywords.
references:
  - https://bad-jubies.github.io/RCE-NOW-WHAT/
  - https://m365internals.com/2022/10/07/hunting-in-on-premises-exchange-server-logs/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/webserver_generic/web_win_webshells_in_access_logs.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2017-02-19
modified: 2022-11-18
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: GET
  selection_keywords:
    - =whoami
    - =net%20user
    - =net+user
    - =net%2Buser
    - =cmd%20/c%
    - =cmd+/c+
    - =cmd%2B/c%
    - =cmd%20/r%
    - =cmd+/r+
    - =cmd%2B/r%
    - =cmd%20/k%
    - =cmd+/k+
    - =cmd%2B/k%
    - =powershell%
    - =powershell+
    - =tasklist%
    - =tasklist+
    - =wmic%
    - =wmic+
    - =ssh%
    - =ssh+
    - =python%
    - =python+
    - =python3%
    - =python3+
    - =ipconfig
    - =wget%
    - =wget+
    - =curl%
    - =curl+
    - =certutil
    - =copy%20%5C%5C
    - =dsquery%
    - =dsquery+
    - =nltest%
    - =nltest+
  condition: all of selection_*
falsepositives:
  - Web sites like wikis with articles on os commands and pages that include the os commands in the URLs
  - User searches in search boxes of the respective website
level: high
license: DRL-1.1
related:
  - id: 7ff9db12-1b94-4a79-ba68-a2402c5d6729
    type: derived

What it detects

This rule flags webserver requests where the GET method includes specific URL-encoded command substrings commonly seen in Windows webshell activity. Attackers use these command patterns to execute or proxy system discovery and command execution via a web-accessible endpoint. It relies on webserver telemetry that captures the HTTP method and the raw request target/parameters containing the matched keywords.

Known false positives

Web sites like wikis with articles on os commands and pages that include the os commands in the URLs
User searches in search boxes of the respective website

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.