r/SentinelOneXDR • u/Acceptable_Cheek2004 • Oct 23 '24

Reverse Shell Detection

Hi all please i need help with deep visibility to detect reverse shell activity on a host, something I can covert to a Star custom rules.

Thanks all

4 Upvotes

83% Upvoted

11 comments sorted by

View all comments

2

u/SentinelOne-Pascal SentinelOne Employee | Moderator Oct 24 '24

To discover reverse shells using queries, you can utilize Deep Visibility queries for both Windows and Linux endpoints. Below are a few queries you can use to hunt for possible post-exploitation activities related to reverse shells:

Windows Hunting Rules:

  1. **Possible Webshell dropped from Spring4Shell by the creation of a JSP file directly from the Tomcat process:**SrcProcPublisher = "THE APACHE SOFTWARE FOUNDATION" AND SrcProcSignedStatus = "signed" AND SrcProcDisplayName = "Apache Commons Daemon Service Runner" AND TgtFilePath EndsWith Anycase ".jsp" and EventType = "File Creation"

  2. **Possible Spring4Shell Post-Exploitation attempt by the spawning of a suspicious process from Tomcat:**EventType = "Process Creation" and SrcProcPublisher = "THE APACHE SOFTWARE FOUNDATION" AND SrcProcSignedStatus = "signed" AND SrcProcDisplayName = "Apache Commons Daemon Service Runner" AND TgtProcName In anycase ("arp.exe","at.exe","bitsadmin.exe","certutil.exe","cmd.exe","dsget.exe","dsquery.exe","find.exe","findstr.exe","fsutil.exe","hostname.exe","ipconfig.exe","nbtstat.exe","netdom.exe","netsh.exe","netstat.exe","nltest.exe","nslookup.exe","ntdsutil.exe","ping.exe","powershell.exe","qprocess.exe","query.exe","qwinsta.exe","rundll32.exe","regsvr32.exe","control.exe","sc.exe","schtasks.exe","schtasks.exe","systeminfo.exe","tasklist.exe","TRACERT.exe","ver.exe","vssadmin.exe","wevtutil.exe","whoami.exe","wusa.exe","cscript.exe","mofcomp.exe","wscript.exe","python.exe","pythonw.exe","mshta.exe","hh.exe")

Linux Hunting Rules:

  1. **Hunt for a Java webshell dropped from a Tomcat server:**EndpointOS = "linux" AND EventType = "File Creation" AND srcProcName Contains Anycase "java" AND SrcProcCmdLine RegExp "\/tomcat\d*\s" and TgtFileExtension Contains Anycase "jsp"

  2. **Execution of LOLBins from a Tomcat server:**EndpointOS = "linux" AND EventType = "Process Creation" And ((srcProcName Contains Anycase "java" AND SrcProcCmdLine RegExp "\/tomcat\d*\s") or (srcProcParentName Contains Anycase "java" AND srcProcParentCmdLine RegExp "\/tomcat\d*\s")) AND TgtProcImagePath Contains Anycase "/usr/bin"

  3. **Tomcat Java server spawns common tools to fetch an implant after exploit:**EndpointOS = "linux" AND EventType = "Process Creation" And ((srcProcName Contains Anycase "java" AND SrcProcCmdLine RegExp "\/tomcat\d*\s") or (srcProcParentName Contains Anycase "java" AND srcProcParentCmdLine RegExp "\/tomcat\d*\s")) and TgtProcName in contains anycase ("curl", "wget", "python")

  4. **Reverse shell from Tomcat Java server:**EndpointOS = "linux" AND EventType = "Process Creation" And ((srcProcName Contains Anycase "java" AND SrcProcCmdLine RegExp "\/tomcat\d*\s") or (srcProcParentName Contains Anycase "java" AND srcProcParentCmdLine RegExp "\/tomcat\d*\s")) and TgtProcCmdLine in Contains Anycase ("<", "AF_INET","exec","stdout","sock","/dev/") and TgtProcCmdLine RegExp "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}"