Webserver Log Detection of ReGeorg Webshell HTTP POST Probing (URI Query)

title: Webserver Log Detection of ReGeorg Webshell HTTP POST Probing (URI Query)
id: 57048b7f-8412-40b3-86e0-fa7188b8e8b6
status: test
description: This rule identifies likely ReGeorg webshell activity by matching specific parameter patterns in the web request URI query. It further narrows events to HTTP POST requests with null referer and null user-agent, which can characterize automated probing by webshell backdoors. The detection relies on webserver telemetry fields including the full URI query, referer, user-agent, and HTTP method.
references:
  - https://community.rsa.com/community/products/netwitness/blog/2019/02/19/web-shells-and-netwitness-part-3
  - https://github.com/sensepost/reGeorg
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/webserver_generic/web_webshell_regeorg.yml
author: Cian Heasley, Huntrule Team
date: 2020-08-04
modified: 2023-01-02
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query|contains:
      - cmd=read
      - connect&target
      - cmd=connect
      - cmd=disconnect
      - cmd=forward
  filter:
    cs-referer: null
    cs-user-agent: null
    cs-method: POST
  condition: selection and filter
falsepositives:
  - Web applications that use the same URL parameters as ReGeorg
level: high
license: DRL-1.1
related:
  - id: 2ea44a60-cfda-11ea-87d0-0242ac130003
    type: derived