Canvas LMS Availability Breach: Mitigating Service Disruption & Web Exploits

---
title: Potential Web Shell or RCE Activity via Nginx/Apache Parent Process
id: 8a2d1e45-9c7b-4f3a-8b1d-2e4f6a7c8d9e
status: experimental
description: Detects potential web shell execution or RCE by monitoring the web server process spawning shells or system utilities. This correlates to web exploitation attacks leading to service disruption.
references:
  - https://attack.mitre.org/techniques/T1505/003
author: Security Arsenal
date: 2024/12/20
tags:
  - attack.initial_access
  - attack.web_shells
  - attack.t1505.003
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentProcessName|endswith:
      - '/nginx'
      - '/apache2'
      - '/httpd'
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/perl'
      - '/python'
      - '/nc'
      - '/telnet'
  condition: selection
falsepositives:
  - Legitimate administrative scripts executed by web developers
level: high
---
title: Linux System Crash or Restart Following Network Flood
id: 9b3e2f56-0d8c-5e4b-9c2e-3f5a7b8d9e0f
status: experimental
description: Detects signs of a system restart or crash which may occur during a resource exhaustion attack or kernel panic induced by a vulnerability exploit.
references:
  - https://attack.mitre.org/techniques/T1499/
author: Security Arsenal
date: 2024/12/20
tags:
  - attack.impact
  - attack.t1499
logsource:
  category: system
  product: linux
detection:
  selection:
    message|contains:
      - 'systemd-shutdow'
      - 'kernel: BUG: soft lockup'
      - 'Out of memory'
  condition: selection
falsepositives:
  - Legitimate system maintenance or hardware failure
level: medium


**KQL (Microsoft Sentinel / Defender)**

// Hunt for high-volume HTTP errors or potential DoS traffic against LMS hosts
let StartTime = ago(24h);
let EndTime = now();
CommonSecurityLog
| where TimeGenerated between(StartTime..EndTime)
| where DeviceProduct in ("NGINX", "Apache")
| where DestinationPort == 443 or DestinationPort == 80
// Look for high volume of 4xx or 5xx errors which often precede or indicate a service disruption
| where DeviceAction in ("Connection Refused", "Request Timeout", "503 Service Unavailable", "502 Bad Gateway")
| summarize Count = count() by SourceIP, DestinationHostName, DeviceAction
| where Count > 100
| order by Count desc


**Velociraptor VQL**

-- Hunt for unusual parent-child process relationships on Linux LMS servers
SELECT Pid, Ppid, Name, Exe, CommandLine, Username
FROM pslist()
WHERE Pid in (SELECT Pid FROM pslist() WHERE Name =~ 'nginx' OR Name =~ 'httpd')
   AND Name =~ 'sh'
   OR Name =~ 'bash'
   OR Name =~ 'python'
   OR Name =~ 'perl'
   OR Name =~ 'nc'


**Remediation Script (Bash)**

#!/bin/bash
# Canvas LMS Stability Check & Remediation Script
# Run with elevated privileges

echo "[+] Checking Web Server Status..."
if systemctl is-active --quiet nginx || systemctl is-active --quiet apache2; then
    echo "[OK] Web server is running."
else
    echo "[ALERT] Web server is down. Attempting restart..."
    if command -v nginx &> /dev/null; then
        systemctl restart nginx
    elif command -v apache2 &> /dev/null; then
        systemctl restart apache2
    fi
fi

echo "[+] Checking for recent changes to web config..."
# Find config modified in last 24 hours
find /etc/nginx /etc/apache2 -mtime -1 -type f -exec ls -lt {} \;

echo "[+] Verifying SSL Certificates..."
# Ensure certs are valid (prevent SSL errors causing outages)
if command -v openssl &> /dev/null; then
    echo "Q" | openssl s_client -connect localhost:443 2>/dev/null | grep "Verify return code"
fi

echo "[+] Checking system load averages..."
uptime

echo "[+] Reviewing recent error logs for exploitation indicators..."
# Check for common web attack signatures in the last 1000 lines
tail -n 1000 /var/log/nginx/error.log 2>/dev/null | grep -iE "\[error\]|failed|permission|denied" || tail -n 1000 /var/log/apache2/error.log 2>/dev/null | grep -iE "\[error\]|failed|permission|denied"