Detection of Web Server-Created High-Entropy Files

This threat brief focuses on detecting the creation of suspicious files by web server processes on Linux systems. Attackers frequently exploit vulnerabilities in public-facing applications to upload malicious payloads. When these payloads are obfuscated, encrypted, or packed to evade signature-based detection, they often exhibit high file entropy. By monitoring for the creation of files with high entropy (typically defined as >= 6.0 in this context) and web-executable extensions (such as .php, .jsp, or .aspx) within directories accessible to web server processes, security operations teams can identify potential web shell plants or unauthorized backdoors. This technique is a common precursor to establishing persistent remote access and conducting further lateral movement within a compromised environment. Defenders should focus on correlating file creation events with web access logs and process execution metadata to confirm malicious intent.

Attack Chain

1. Attacker identifies a public-facing web application with an insecure file upload or remote code execution vulnerability.
2. Attacker crafts a malicious web shell payload, potentially using obfuscation or packing techniques to bypass basic security controls.
3. Attacker sends an HTTP request to the vulnerable application endpoint, triggering the web server process to write the payload to disk.
4. The web server process, running with its associated service account, creates a new file in a web-accessible directory.
5. The file exhibits high entropy due to the encoded or encrypted nature of the malicious code.
6. Attacker invokes the newly created file over HTTP to execute arbitrary commands on the underlying host.
7. Attacker establishes persistent remote code execution and may proceed to move laterally within the network.

Impact

Successful exploitation allows attackers to achieve persistent remote code execution, leading to data exfiltration, internal network reconnaissance, and potential full system compromise. The impact is significant for organizations relying on public-facing web applications, as these serve as initial entry points for broad-spectrum compromises.

Recommendation

1. Deploy the provided detection logic to identify high-entropy files created by web server processes.
2. Configure endpoint security agents to enable advanced file metadata capture (e.g., linux.advanced.events.populate_file_data set to true for Elastic Defend).
3. Correlate alerts triggered by this rule with web server and reverse-proxy logs to identify the source IP addresses and specific HTTP requests associated with the file creation.
4. Perform periodic audits of web-accessible directories to detect unauthorized file additions that do not correlate with legitimate CI/CD or deployment pipelines.
5. Harden web server configurations to prevent execution in file upload directories and enforce strict file extension and content validation.