nsacyber / mitigating-web-shells Goto Github PK

Hello,

I've noticed that you have included several detailed instructions for Microsoft IIS as well as Apache. I wonder if you could also make some recommendations for nginx — it's an increasingly popular web server, with almost as much market share as Apache. While web server log analysis can be used with relative facility (nginx can write its logs in Apache format), other tools mentioned on your documentation do not apply.

Thanks in advance!

Good Afternoon,

Does anyone know a workaround when working with InQuest implementing YARA rules without string data? The error states:
Failed to validate rule files against yara. Yara validation output: /tmp/signature-input-603fcb1f91510(28): syntax error, unexpected . expecting string identifier

The rule in question:

rule hiddenFunctionality
{
meta:
author = "NSA Cybersecurity"
description = "Hidden functionality allows malware to masquerade as another filetype"

condition:
    phpInImage

}

See nbs-system/php-malware-finder#3

Your current license is bullshit, and I would appreciate that you don't steal my code if you can't abide by its license.

what have they ever done to not earn your trust, goyim.

please.

get lost

https://github.com/nsacyber/Mitigating-Web-Shells#powershell-script-to-identify-sysmon-entries-for-iis

Please fix typo:

Get-WinEvent -FilterHashtable @{logname="Micorosft-Windows-Sysmon/Operational";id=1;} | Where {$.message -like "ParentImage: C:\Windows\System32\inetsrv\w3wp.exe"} | %{$.properties[4]} | Sort-Object -Property value -Unique

Corrected (Microsoft)
Get-WinEvent -FilterHashtable @{logname="Microsoft-Windows-Sysmon/Operational";id=1;} | Where {$.message -like "ParentImage: C:\Windows\System32\inetsrv\w3wp.exe"} | %{$.properties[4]} | Sort-Object -Property value -Unique

LogCheck.py

Traceback (most recent call last):
File "LogCheck.py.2", line 111, in
analyze_weblog(weblogfileName)
File "LogCheck.py.2", line 40, in analyze_weblog
user_agent = row[apachelogsfields.index('user_agent')]
IndexError: list index out of range

Logfile :
wc -l /var/srvlog/2021.04/access.log

400053 /var/srvlog/2021.04/doktori/access.log

It works with a smaller size:
wc -l /var/srvlog/2021.03/access.log
229303 /var/srvlog/2021.03/access.log