Tom Saul
@ts830 followers22 downloads8 copies0 likes107 views
2 detections
Filters
Last updated
All Time
Detection languages
2
Categories
2
Platforms
2
MITRE Techniques
2
2
2
1
1
Detects SessionReaper webshell activity on Magento e-commerce platforms, including process execution from suspicious media directories.
This rule detects PolyShell webshell activity on Linux systems, specifically targeting Magento e-commerce platforms. It identifies processes executing from or targeting a suspicious media directory (`/var/www/prod/shared/pub/media/custom_options/quote/i/n/`) in conjunction with `curl` processes retrieving payloads from the `gsocket.io` C2 network. The detection logic combines indicators of webshell presence (execution from a specific directory) with C2 communication (curl to gsocket.io).