Detects web shell files in AhnLab EPP V3 malware alert logs.

Overview

Priority	High
Type	Stream
Log schema	ahnlab-epp-v3-malware
Message	안랩 EPP V3 웹쉘 탐지: 호스트 $host_ip, 악성코드 $signature
Output field order	_log_time, hostname, host_ip, emp_name, dept_name, signature, file_path, file_status, md5
MITRE Techniques	T1505.003 Server Software Component: Web Shell
MITRE tactics	TA0003 Persistence

Query

The AhnLab V3 antivirus engine detects web shell files using signatures such as WebShell/JSP.Generic.S1910. Therefore, alerts containing the string WebShell/ in the signature field are extracted.

Target logger models

• AhnLab EPP syslog

Threat analysis

• A web shell is a type of malicious script that attackers upload to a server to perform remote command execution, file manipulation, and deployment of additional malware.
• Detection of a web shell indicates that the server may already be compromised or that an attacker has successfully attempted to upload a malicious script, potentially establishing persistence.
• Web shells are commonly installed through web server vulnerabilities or abuse of file upload functionalities, so immediate investigation is required.

False positives

• Rare false positives may occur when internally developed or operational tools containing JSP or PHP scripts are misidentified.
• However, files matching the WebShell/ signature should not normally exist in a legitimate environment, so the false-positive likelihood is very low.

Response actions

• Review the file path and contents of the detected file to determine whether it is an actual web shell.
• If a web shell is present, isolate the server and investigate the scope of compromise using web logs, firewall session logs, and process creation records.
• Check for additional malicious scripts uploaded to the same server and verify whether unauthorized administrative accounts have been created.
• Conduct a web application vulnerability assessment to close or secure upload paths or vulnerable functionalities, and strengthen web server access control and web firewall policies.