Write the Sigma Rule: Catch a Webshell by Its Children

A web server here, web01, has a webshell in its uploads folder, and someone is running commands through it. Your telemetry is Sysmon for Linux process-creation events, one JSON object per line, in /var/log/sysmon/process_creation.jsonl. Each event names the new process (Image, CommandLine, User) and the process that started it (ParentImage, ParentCommandLine).

Eyeballing it once is not the job. Write the Sigma rule a SOC would deploy to catch this on every web server in the fleet.

1. Hunt. Find the events where the web stack itself started something it never should. Most of what the web stack starts is normal: worker processes, PHP's mail() calling sendmail, log rotation, config tests. Cron and admins also run curl and shells all day.

2. Write the rule at /home/student/rules/webshell-spawn.yml. It needs a title, a logsource of product: linux and category: process_creation, and a detection block with a condition. example-base64-pipe.yml in the same folder shows the format for an unrelated detection.

3. Write it for the technique, not today's one host. The behavior to detect is a web server process (nginx, apache2, httpd, or a php-fpm worker) starting a shell (sh, bash, dash) or a download tool (curl, wget). Grading also runs your rule over an unseen log from a different web stack.

4. Tune it. Every attack event must match, and no benign event may, in either log.

5. Map it. Tag the rule with the MITRE ATT&CK technique for a web shell, in Sigma's tag format.

sigma-hunt is installed for testing: sigma-hunt --check RULE validates a rule and sigma-hunt RULE LOG prints what it matches. It supports the core of the Sigma spec and rejects anything outside it, so a rule it accepts is valid Sigma.