Try in Splunk Security Cloud

Description

The following analytic identifies an attempt to access the Remote ShellServlet on a web server. This servlet is used to execute commands on the server. This activity is often associated with web shells and other malicious activity. This activity was identified against a Confluence server related to CVE-2023-22518 and CVE-2023-22515. Activity prior to access to the shell servlet include adding a plugin to Confluence. In addition, monitor for ShellServlet?act=3, ShellServlet or obfuscated variations including Sh3llServlet1.

  • Type: TTP
  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Web
  • Last Updated: 2023-11-22
  • Author: Michael Haag, Splunk
  • ID: c2a332c3-24a2-4e24-9455-0e80332e6746

Annotations

ATT&CK

ATT&CK

ID Technique Tactic
T1190 Exploit Public-Facing Application Initial Access
Kill Chain Phase
  • Delivery
NIST
  • DE.CM
CIS20
  • CIS 13
CVE 


1
2
3
4
5
6



| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Web where Web.url IN ("*plugins/servlet/com.jsos.shell/*") Web.status=200 by Web.http_user_agent, Web.status Web.http_method, Web.url, Web.url_length, Web.src, Web.dest, sourcetype 
| `drop_dm_object_name("Web")` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `web_remote_shellservlet_access_filter`

Macros

The SPL above uses the following Macros:

:information_source: web_remote_shellservlet_access_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Required fields

List of fields required to use this analytic.

  • Web.http_user_agent
  • Web.status
  • Web.http_method
  • Web.url
  • Web.url_length
  • Web.src
  • Web.dest
  • sourcetype

How To Implement

The following analytic requires collection of Web data. The data can be collected via Splunk Stream, or by using the Splunk Add-on for Apache Web Server. The analytic does not require any additional configuration.

Known False Positives

False positives may be present based on the web server configuration. If the web server is configured to use the Remote ShellServlet, then this analytic will not be a true positive.

Associated Analytic Story

RBA

Risk Score Impact Confidence Message
81.0 90 90 An attempt to access the Remote ShellServlet on a web server was detected. The source IP is $src$ and the destination hostname is $dest$.

:information_source: The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

Reference

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 1