id: 15a8f236-3b55-55e9-afd0-be581a551778
name: PHP2Shell - Web server reaches a new destination
description: |
  'The web server, a PHP worker or a process they started connected to a public address it had not contacted in the previous 14 days: second-stage downloads, reverse shells and miners. Applications calling new APIs will also match.'
severity: Medium
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - DeviceNetworkEvents
queryFrequency: 1h
queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - CommandAndControl
relevantTechniques:
  - T1105
  - T1071.001
query: |
  // PHP2Shell follow-on traffic: outbound connections from the web server tree to public addresses not seen in the last 14 days.
  let Recent = 1h;
  let WebServer = @"(?i)^(php(-fpm|-cgi)?[0-9.]*(\.exe)?|apache2|httpd(\.exe)?|lsphp|frankenphp)$";
  let Outbound = dynamic(["ConnectionSuccess", "ConnectionAttempt", "ConnectionRequest"]);
  let Known = DeviceNetworkEvents
  | where TimeGenerated < ago(Recent)
  | where ActionType in (Outbound) and RemoteIPType == "Public"
  | where InitiatingProcessFileName matches regex WebServer or InitiatingProcessParentFileName matches regex WebServer
  | distinct DeviceId, RemoteIP;
  DeviceNetworkEvents
  | where TimeGenerated >= ago(Recent)
  | where ActionType in (Outbound) and RemoteIPType == "Public"
  | where InitiatingProcessFileName matches regex WebServer or InitiatingProcessParentFileName matches regex WebServer
  | join kind=leftanti Known on DeviceId, RemoteIP
  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), Connections = count(), Ports = make_set(RemotePort, 10), Urls = make_set(RemoteUrl, 10) by DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RemoteIP
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: DeviceName
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: InitiatingProcessAccountName
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: RemoteIP
eventGroupingSettings:
  aggregationKind: AlertPerResult
version: 1.0.0
kind: Scheduled