DEWMODE Webshell Access

Detects access to DEWMODE webshell as described in FIREEYE report

title: DEWMODE Webshell Access
id: fdf96c90-42d5-4406-8a9c-14a2c9a016b5
status: test
description: Detects access to DEWMODE webshell as described in FIREEYE report
references:
    - https://www.mandiant.com/resources/blog/accellion-fta-exploited-for-data-theft-and-extortion
author: Florian Roth (Nextron Systems)
date: 2021-02-22
modified: 2023-01-02
tags:
    - attack.persistence
    - attack.t1505.003
    - detection.emerging-threats
logsource:
    category: webserver
detection:
    selection1:
        cs-uri-query|contains|all:
            - '?dwn='
            - '&fn='
            - '.html?'
    selection2:
        cs-uri-query|contains|all:
            - '&dwn='
            - '?fn='
            - '.html?'
    condition: 1 of selection*
falsepositives:
    - Unknown
level: high

• T1505.003Web Shell

• https://www.mandiant.com/resources/blog/accellion-fta-exploited-for-data-theft-and-extortion↗