P.A.S. Webshell

"Initial Access T1190 Exploit Public-Facing Application Uses Centreon UI"

APT19 downloaded and launched code within a SCT file; APT32 used COM scriptlets to download Cobalt Strike beacons; APT37 used Ruby scripts to execute payloads; ArcaneDoor included the adversary executing command line interface (CLI) commands.

Fox Kitten has used a Perl reverse shell to communicate with C2. P.A.S. Webshell has the ability to create reverse shells with Perl scripts. SpeakUp uses Perl scripts. Windigo has used a Perl script for information gathering. | Bonadan can create bind and reverse shells on the infected system. Kessel can create a reverse shell... WINERACK can create a reverse shell... P.A.S. Webshell has the ability to create reverse shells with Perl scripts.

"Execution T1059.004 Command and Scripting Interpreter - Unix Shell Linux shell use" and "OS.ShellExecute – runs a shell command"

During Cutting Edge, threat actors used Perl scripts to enable the deployment of the THINSPOOL shell script dropper and for enumerating host data. Fox Kitten has used a Perl reverse shell to communicate with C2. P.A.S. Webshell has the ability to create reverse shells with Perl scripts. Windigo has used a Perl script for information gathering.

ANSSI has been informed of an intrusion campaign targeting the monitoring software Centreon distributed by the French company CENTREON which resulted in the breach of several French entities.

Descriptions repeatedly identify server-side implants such as "Web shell - file ASPXspy2.aspx", "Detects a ASPX web shell", "Detects JexBoss JSPs", and "Webshell that uses standard Wordpress wp-config.php file and appends the malicious code in front of it". | The content is a large YARA ruleset explicitly focused on web shells, e.g. rule names and descriptions such as "Webshell_Insomnia", "JSP_Browser_APT_webshell", "WEBSHELL_ASPX_Mar21_1", and "Detects a tiny webshell - chine chopper".

Examples include "eval(gzinflate(str_rot13(base64_decode('", "Obfuscation provided by FOPO", and encoded constructs such as "preg_replace(\"/.*/e\",\"\\x65\\x76\\x61\\x6C...".

The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.

The content is a long ATT&CK-style listing of malware and threat groups that 'decrypt', 'decode', 'deobfuscate', 'unpack', or 'decompress' payloads, strings, configuration data, shellcode, and files prior to execution or use.

The content repeatedly describes threat actors and malware performing network scanning, port scanning, service enumeration, OS fingerprinting, and identifying open ports/services across victim environments.

The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.

“actors used the following commands… to enumerate user accounts: net user >> %temp%\download; net user /domain >> %temp%\download … APT1 used the commands net localgroup, net user, and net group to find accounts… APT32 enumerated administrative users using the commands net localgroup administrators … OilRig has run net user, net user /domain, net group "domain admins" /domain …”

"Bazar can query the Registry for installed applications"; "BRONZE BUTLER has used tools to enumerate software installed"; "Volt Typhoon has queried the Registry...for information on installed software"; "Windigo has used a script to detect installed software"

Andariel has collected large numbers of files from compromised network systems for later extraction... APT28 has retrieved internal documents from machines inside victim environments... BADNEWS crawls the victim's local drives and collects documents... many listed groups and malware collect files, documents, credentials, payment card data, or other information from compromised hosts.

The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications. | Specific implementations mentioned include 'HTTP POST requests,' 'HTTP GET requests,' 'custom HTTP cookies,' 'Cookie HTTP header,' 'HTTP Upgrade request' for WebSocket initiation, and use of APIs such as 'Microsoft Graph API' or 'Dropbox HTTP API' for C2.

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."

Bonadan can create bind and reverse shells on the infected system. gh0st RAT is able to open a remote shell to execute commands. Whitefly has used a simple remote shell tool that will call back to the C2 server and wait for commands.