Cookie-Controlled PHP Web Shells & Cron Persistence: Detection & Remediation

---
title: Linux Web Server Spawning System Shell
id: a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects web server processes spawning shells, indicative of web shell execution via cookie or parameter exploitation.
references:
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.004
  - attack.web_shell
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|contains:
      - 'apache'
      - 'nginx'
      - 'httpd'
      - 'php-fpm'
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/perl'
  condition: selection
falsepositives:
  - Legitimate server administration scripts (rare for web user context)
level: high
---
title: Web Server User Utilizing Crontab for Persistence
id: b2c3d4e5-f6a7-5b6c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects the web server user (e.g., www-data) executing crontab, a strong indicator of persistence following web shell compromise.
references:
  - https://attack.mitre.org/techniques/T1053/003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1053.003
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: '/crontab'
    User|contains:
      - 'www-data'
      - 'apache'
      - 'nginx'
  condition: selection
falsepositives:
  - Legitimate administrative tasks scheduled by web admins (very rare)
level: critical

DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("apache2", "httpd", "nginx", "php-fpm")
| where FileName in~ ("sh", "bash", "dash", "python", "perl", "php")
| extend HostName = DeviceName
| project Timestamp, HostName, AccountName, InitiatingProcessFileName, FileName, CommandLine, InitiatingProcessCommandLine
| order by Timestamp desc

-- Hunt for PHP files containing $_COOKIE references often used for stealthy C2
SELECT FullPath, Size, Mtime, Mode
FROM glob(globs='/var/www/**/*.php')
WHERE read_file(filename=FullPath) =~ '\$_COOKIE'
   OR read_file(filename=FullPath) =~ 'eval\(.*\$_COOKIE'

#!/bin/bash

# Hunt for Cookie-Controlled PHP Web Shells and Cron Persistence
# Usage: sudo ./hunt_webshell.sh

echo "[*] Starting hunt for Cookie-Controlled Web Shells..."

# Define web roots (adjust as necessary)
WEB_ROOTS=("/var/www/html" "/var/www" "/usr/share/nginx/html")

# 1. Search for PHP files using $_COOKIE for C2
echo "[+] Scanning for PHP files referencing \$_COOKIE (potential C2 channel)..."
for root in "${WEB_ROOTS[@]}"; do
    if [ -d "$root" ]; then
        grep -r -l -i '\$_COOKIE' "$root" --include="*.php" 2>/dev/null | while read -r file; do
            # Filter out common framework libraries to reduce noise (example filter)
            if ! echo "$file" | grep -qiE "vendor|framework|lib"; then
                echo "[!] Suspicious file found: $file"
                # Optional: Print context
                # grep -i '\$_COOKIE' "$file" | head -n 2
            fi
        done
    fi
done

# 2. Check for Cron Persistence by web users
echo "[*] Checking for crontab persistence by web users..."
WEB_USERS=("www-data" "apache" "nginx")

for user in "${WEB_USERS[@]}"; do
    # Check if user exists and has a crontab
    if id "$user" &>/dev/null; then
        CRON_FILE="/var/spool/cron/crontabs/$user"
        if [ -f "$CRON_FILE" ]; then
            echo "[!] Crontab found for $user:"
            cat "$CRON_FILE"
        fi
        # Also try crontab -l if permissions allow or running as root
        if [ "$EUID" -eq 0 ]; then
            crontab -u "$user" -l 2>/dev/null && echo "[!] Crontab listing for $user (via crontab -l):"
        fi
    fi
done

echo "[*] Hunt complete. Review findings above."