security_content/detections/web/web_remote_shellservlet_access.yml at develop · Sims24/security_content · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
name: Web Remote ShellServlet Access
id: c2a332c3-24a2-4e24-9455-0e80332e6746
version: 2
date: '2024-04-02'
author: Michael Haag, Splunk
status: production
type: TTP
data_source:
- Nginx Access
description: This analytic identifies attempts to access the Remote ShellServlet on a web server, which is utilized to execute commands. Such activity is commonly linked with web shells and other forms of malicious behavior. It was specifically detected on a Confluence server in relation to CVE-2023-22518 and CVE-2023-22515. Activities preceding access to the shell servlet include the addition of a plugin to Confluence. Additionally, it is advisable to monitor for ShellServlet?act=3, ShellServlet, or obfuscated variations such as Sh3llServlet1.
search: '| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Web where Web.url IN ("*plugins/servlet/com.jsos.shell/*") Web.status=200 by Web.http_user_agent, Web.status Web.http_method, Web.url, Web.url_length, Web.src, Web.dest, sourcetype
  | `drop_dm_object_name("Web")`
  | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)` | `web_remote_shellservlet_access_filter`'
how_to_implement: This analytic necessitates the collection of web data, which can be achieved through Splunk Stream or by utilizing the Splunk Add-on for Apache Web Server. No additional configuration is required for this analytic.
known_false_positives: False positives may occur depending on the web server's configuration. If the web server is intentionally configured to utilize the Remote ShellServlet, then the detections by this analytic would not be considered true positives.
references:
- http://www.servletsuite.com/servlets/shell.htm
tags:
  analytic_story:
  - CVE-2023-22515 Privilege Escalation Vulnerability Confluence Data Center and Server
  asset_type: Web Server
  atomic_guid: []
  confidence: 90
  impact: 90
  message: An attempt to access the Remote ShellServlet on a web server was detected. The source IP is $src$ and the destination hostname is $dest$.
  mitre_attack_id:
  - T1190
  observable:
  - name: src
    type: IP Address
    role:
    - Attacker
  - name: dest
    type: Hostname
    role:
    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  risk_score: 81
  required_fields:
  - Web.http_user_agent
  - Web.status
  - Web.http_method
  - Web.url
  - Web.url_length
  - Web.src
  - Web.dest
  - sourcetype
  security_domain: network
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/confluence/nginx_shellservlet.log
    source: /var/log/nginx/access.log
    sourcetype: nginx:plus:kv