id: 6bbdb4a8-2890-5061-ac24-5bca80d57c40
name: PHP2Shell - Persistence by the web server account
description: |
  'The web server account, or a process started by the web server, edited cron, systemd units or SSH keys, or ran crontab, useradd or ssh-keygen. Attackers use these to survive patching. Add your site accounts to WebAccounts.'
severity: High
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - DeviceProcessEvents
      - DeviceFileEvents
queryFrequency: 30m
queryPeriod: 30m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Persistence
relevantTechniques:
  - T1053.003
  - T1098.004
  - T1543.002
query: |
  // PHP2Shell persistence that survives the patch: cron, systemd and SSH keys changed from the web server's side.
  let WebServer = @"(?i)^(php(-fpm|-cgi)?[0-9.]*(\.exe)?|apache2|httpd(\.exe)?|lsphp|frankenphp)$";
  let WebAccounts = dynamic(["www-data", "apache", "nginx", "httpd", "REPLACE_WITH_SITE_ACCOUNT"]);
  let Processes = DeviceProcessEvents
  | where AccountName in~ (WebAccounts) or InitiatingProcessFileName matches regex WebServer or InitiatingProcessParentFileName matches regex WebServer
  | where FileName in~ ("crontab", "at", "ssh-keygen", "useradd", "usermod", "systemctl")
  | project TimeGenerated, DeviceName, AccountName, Activity = strcat("ran ", FileName), Detail = ProcessCommandLine;
  let Files = DeviceFileEvents
  | where ActionType in ("FileCreated", "FileModified", "FileRenamed")
  | where InitiatingProcessAccountName in~ (WebAccounts) or InitiatingProcessFileName matches regex WebServer or InitiatingProcessParentFileName matches regex WebServer
  | where FolderPath has_any ("/var/spool/cron", "/etc/cron", "/etc/systemd/system", "/.ssh/") or FileName =~ "authorized_keys"
  | project TimeGenerated, DeviceName, AccountName = InitiatingProcessAccountName, Activity = strcat("wrote ", FileName), Detail = FolderPath;
  union Processes, Files
  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), Activities = make_set(Activity, 10), Details = make_set(Detail, 10) by DeviceName, AccountName
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: DeviceName
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountName
eventGroupingSettings:
  aggregationKind: AlertPerResult
version: 1.0.0
kind: Scheduled