What it does. Runs a hypothesis-driven threat hunt for web shell deployment (T1505.003) on internet-facing servers by analyzing file creation in web directories, suspicious child-process spawning from web server processes, and anomalous HTTP request patterns. Use when hunting for web shells after a public-facing app compromise, when EDR/SIEM alerts fire on webserver process anomalies, or during incident response on internet-facing infrastructure. Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill hunting-for-webshell-activity, or copy the skill folder into ~/.claude/skills/hunting-for-webshell-activity/.- Raw file:
curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-webshell-activity/SKILL.md
SKILL.md (verbatim)
name: hunting-for-webshell-activity
description: Runs a hypothesis-driven threat hunt for web shell deployment (T1505.003) on internet-facing servers by analyzing file creation in web directories, suspicious child-process spawning from web server processes, and anomalous HTTP request patterns. Use when hunting for web shells after a public-facing app compromise, when EDR/SIEM alerts fire on webserver process anomalies, or during incident response on internet-facing infrastructure.
domain: cybersecurity
subdomain: threat-hunting
tags:
- threat-hunting
- mitre-attack
- webshell
- persistence
- web-server
- t1505
- proactive-detection
version: '1.0'
author: mahipal
license: Apache-2.0
d3fend_techniques:
- Executable Denylisting
- Execution Isolation
- File Metadata Consistency Validation
- Restore Access
- Process Termination
nist_csf:
- DE.CM-01
- DE.AE-02
- DE.AE-07
- ID.RA-05
mitre_attack:
- T1046
- T1057
- T1082
- T1083
- T1547
Hunting For Webshell Activity
When to Use
- When proactively hunting for indicators of hunting for webshell activity in the environment
- After threat intelligence indicates active campaigns using these techniques
- During incident response to scope compromise related to these techniques
- When EDR or SIEM alerts trigger on related indicators
- During periodic security assessments and purple team exercises
Prerequisites
- EDR platform with process and network telemetry (CrowdStrike, MDE, SentinelOne)
- SIEM with relevant log data ingested (Splunk, Elastic, Sentinel)
- Sysmon deployed with comprehensive configuration
- Windows Security Event Log forwarding enabled
- Threat intelligence feeds for IOC correlation
Workflow
- Formulate Hypothesis: Define a testable hypothesis based on threat intelligence or ATT&CK gap analysis.
- Identify Data Sources: Determine which logs and telemetry are needed to validate or refute the hypothesis.
- Execute Queries: Run detection queries against SIEM and EDR platforms to collect relevant events.
- Analyze Results: Examine query results for anomalies, correlating across multiple data sources.
- Validate Findings: Distinguish true positives from false positives through contextual analysis.
- Correlate Activity: Link findings to broader attack chains and threat actor TTPs.
- Document and Report: Record findings, update detection rules, and recommend response actions.
Key Concepts
| Concept |
Description |
| T1505.003 |
Web Shell |
| T1190 |
Exploit Public-Facing Application |
| T1059.001 |
PowerShell |
| Tool |
Purpose |
| CrowdStrike Falcon |
EDR telemetry and threat detection |
| Microsoft Defender for Endpoint |
Advanced hunting with KQL |
| Splunk Enterprise |
SIEM log analysis with SPL queries |
| Elastic Security |
Detection rules and investigation timeline |
| Sysmon |
Detailed Windows event monitoring |
| Velociraptor |
Endpoint artifact collection and hunting |
| Sigma Rules |
Cross-platform detection rule format |
Common Scenarios
- Scenario 1: China Chopper web shell via IIS vulnerability
- Scenario 2: ASPXSpy through vulnerable upload
- Scenario 3: PHP shell hidden in image file
- Scenario 4: JSP shell via Tomcat manager console
Hunt ID: TH-HUNTIN-[DATE]-[SEQ]
Technique: T1505.003
Host: [Hostname]
User: [Account context]
Evidence: [Log entries, process trees, network data]
Risk Level: [Critical/High/Medium/Low]
Confidence: [High/Medium/Low]
Recommended Action: [Containment, investigation, monitoring]
Other files in this skill
assets/template.md (verbatim)
Hunting For Webshell Activity - Hunt Template
| Field |
Value |
| Hunt ID |
TH-HUNTIN-YYYY-MM-DD-NNN |
| Analyst |
|
| Date Started |
|
| Date Completed |
|
| Status |
[ ] In Progress / [ ] Complete |
| Priority |
[ ] Critical / [ ] High / [ ] Medium / [ ] Low |
Hypothesis
Statement: [Formulate a clear, testable hypothesis]
Basis: [ ] Threat Intel / [ ] ATT&CK Gap / [ ] Anomaly / [ ] Incident Follow-up
Target Techniques
Data Sources
Queries Executed
Query 1: [Description]
[Query text]
Results: [Count] events | Execution Time: [Duration]
Query 2: [Description]
[Query text]
Results: [Count] events | Execution Time: [Duration]
Findings
| # |
Timestamp |
Host |
User |
Technique |
Evidence Summary |
Risk |
Verdict |
| 1 |
|
|
|
|
|
|
TP / FP / BTP |
| 2 |
|
|
|
|
|
|
TP / FP / BTP |
| 3 |
|
|
|
|
|
|
TP / FP / BTP |
IOCs Discovered
Network IOCs
| Type |
Value |
Context |
Confidence |
| IP |
|
|
|
| Domain |
|
|
|
| URL |
|
|
|
Host IOCs
| Type |
Value |
Context |
Confidence |
| SHA256 |
|
|
|
| Filename |
|
|
|
| Registry Key |
|
|
|
| Scheduled Task |
|
|
|
Hunt Results Summary
| Metric |
Count |
| Total Events Analyzed |
|
| Anomalies Identified |
|
| True Positives |
|
| False Positives |
|
| Benign True Positives |
|
| New IOCs Discovered |
|
| Detection Rules Created |
|
| Detection Rules Updated |
|
Hypothesis Outcome
Recommendations
- Immediate Actions: [Containment, remediation steps]
- Detection Improvements: [New rules, tuning recommendations]
- Visibility Gaps: [Missing data sources, coverage needs]
- Security Hardening: [Configuration changes, policy updates]
- Follow-up Hunts: [Related hypotheses to investigate]
Analyst Notes
[Free-form notes, observations, and lessons learned]
references/api-reference.md (verbatim)
API Reference: Hunting for Webshell Activity
Process Tree Detection
| Parent Process |
Child Process |
Severity |
| w3wp.exe |
cmd.exe, powershell.exe |
CRITICAL |
| httpd/apache2 |
bash, sh, python |
CRITICAL |
| tomcat/java |
cmd.exe, bash |
CRITICAL |
| nginx |
bash, sh |
CRITICAL |
Splunk SPL - Web Server Shell Spawn
index=sysmon EventCode=1
| where match(ParentImage, "(?i)(w3wp|httpd|apache2|nginx|tomcat)")
| where match(Image, "(?i)(cmd\.exe|powershell|bash|whoami|net\.exe)")
| table _time Computer ParentImage Image CommandLine User
KQL - Web Shell Process Chain
DeviceProcessEvents
| where InitiatingProcessFileName in~ ("w3wp.exe", "httpd", "apache2", "nginx")
| where FileName in~ ("cmd.exe", "powershell.exe", "bash", "whoami.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine
Web Access Log Patterns
webshell_patterns = [
r"POST\s+.*\.(asp|aspx|php|jsp)\s+", # POST to script files
r"cmd=|exec=|command=|shell=", # Command parameters
r"c99shell|r57shell|b374k|weevely", # Known webshell names
]
Sigma Rule - Webshell Detection
title: Webshell Spawning Shell Process
logsource:
category: process_creation
product: windows
detection:
parent:
ParentImage|endswith: '\w3wp.exe'
child:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
condition: parent and child
level: critical
tags:
- attack.persistence
- attack.t1505.003
References
references/standards.md (verbatim)
Standards and References - Hunting For Webshell Activity
MITRE ATT&CK Mappings
| Technique |
Name |
Description |
| T1505.003 |
Web Shell |
See attack.mitre.org/techniques/T1505/003 |
| T1190 |
Exploit Public-Facing Application |
See attack.mitre.org/techniques/T1190 |
| T1059.001 |
PowerShell |
See attack.mitre.org/techniques/T1059/001 |
Detection Data Sources
| Source |
Event ID |
Purpose |
| Sysmon |
1 |
Process creation with command line |
| Sysmon |
3 |
Network connection initiated |
| Sysmon |
7 |
Image loaded (DLL) |
| Sysmon |
10 |
Process access (LSASS) |
| Sysmon |
11 |
File creation |
| Sysmon |
12/13 |
Registry create/set |
| Sysmon |
22 |
DNS query |
| Sysmon |
25 |
Process tampering |
| Windows Security |
4624 |
Successful logon |
| Windows Security |
4625 |
Failed logon |
| Windows Security |
4648 |
Explicit credential logon |
| Windows Security |
4672 |
Special privileges assigned |
| Windows Security |
4688 |
Process creation |
| Windows Security |
4697 |
Service installed |
| Windows Security |
4698 |
Scheduled task created |
| Windows Security |
4769 |
Kerberos TGS requested |
| Windows Security |
5140 |
Network share accessed |
References
references/workflows.md (verbatim)
Detailed Hunting Workflow - Hunting For Webshell Activity
Phase 1: Data Collection and Querying
Splunk SPL Query
index=sysmon EventCode=1
| where match(ParentImage, "(?i)(w3wp|httpd|nginx|tomcat|java)\.exe")
| where match(Image, "(?i)(cmd|powershell|bash|whoami|net|ipconfig)\.exe")
| table _time Computer User ParentImage Image CommandLine
KQL Query (Microsoft Defender for Endpoint)
DeviceProcessEvents
| where InitiatingProcessFileName in~ ("w3wp.exe","httpd.exe","nginx.exe","java.exe")
| where FileName in~ ("cmd.exe","powershell.exe","whoami.exe","net.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine
Phase 2: Baseline and Anomaly Detection
Step 2.1 - Establish Normal Behavior Baseline
- Collect 30 days of historical data for the targeted technique
- Document expected patterns, frequencies, and legitimate use cases
- Identify known false positive sources and document exceptions
- Build statistical baseline (mean, standard deviation) for key metrics
Step 2.2 - Identify Anomalies
- Compare current activity against the 30-day baseline
- Flag events exceeding 3 standard deviations from normal
- Prioritize anomalies by risk score and potential business impact
- Cross-reference with threat intelligence for known IOCs
Phase 3: Investigation and Correlation
Step 3.1 - Deep Dive Analysis
- For each anomaly, collect full process tree context
- Correlate with network activity, file operations, and authentication events
- Check binary signatures, file hashes, and certificate validity
- Review user account context and access patterns
Step 3.2 - Attack Chain Reconstruction
- Map findings to MITRE ATT&CK kill chain stages
- Identify initial access vector if applicable
- Trace lateral movement and privilege escalation paths
- Determine data access and potential exfiltration
Phase 4: Validation and Response
Step 4.1 - True/False Positive Determination
- Verify findings with system owners and IT operations
- Check change management records for authorized activities
- Validate user context (authorized actions vs. compromised account)
- Document determination rationale for each finding
Step 4.2 - Response Actions
- For confirmed threats: initiate incident response procedures
- For detection gaps: create or update detection rules
- For false positives: tune existing rules and update exclusions
- Update threat hunting playbook with lessons learned
Phase 5: Documentation and Reporting
Step 5.1 - Hunt Report
- Summarize hypothesis, methodology, and findings
- Include all queries executed and their results
- Document IOCs discovered and detection rules created
- Provide recommendations for security improvements
Step 5.2 - Knowledge Base Update
- Add findings to threat intelligence platform
- Update MITRE ATT&CK coverage heatmap
- Share detection rules via Sigma format
- Schedule follow-up hunts for related techniques
Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.