Skip to content
Threat Feed
Subscribe
high advisory

Detection of Windows Webshell Activity via Web Server Logs

This brief provides detection logic for common Windows command-line utilities and shell-spawning techniques observed in web server access logs associated with webshell exploitation.

Triage facts

Revision 1
Evidence
Unknown
Severity
High
Action
Elevated
Sources
1 public source
Freshness
Revision 1Nov 10, 03:35 UTC
Detection
1 rule
Source quality
A2Likely

This intelligence identifies common strings associated with Windows-based webshell interaction, typically seen in the query parameters of GET requests targeting compromised web applications. The provided detection logic aims to identify post-exploitation activity where an adversary uses the web server to execute system commands.

Recommendation

  • Deploy the provided Sigma rule to your SIEM, ingesting web server access logs (e.g., W3C format).
  • Review historical logs for the identified command strings to scope potential past compromises.
  • Tune the detection to exclude internal documentation sites or administrative consoles that legitimately process command strings in query parameters.

Immediate actions

Deploy the Sigma detection rule to monitor web access logs for command execution patterns

Detection Engineering 48h

Threat Hunt

Identify high-frequency GET requests to web applications containing Windows-specific command keywords

T1505.003 medium medium confidence hunt now

Data: Web server access logs (cs-uri-query, cs-method, c-ip, cs-user-agent)

Detection coverage 1

Detect Windows Webshell Command Execution via Webserver Logs

high

Detects GET requests containing common Windows command-line utilities and parameters indicative of webshell interaction

sigma tactics: persistence techniques: T1505.003 sources: webserver

Detection queries are available on the platform. Get full rules →