CVE-2024-33411: Drupal Core Vulnerability Added to CISA KEV — Detection and Remediation

---
title: Potential Drupal Webshell Activity
id: 8a4d2c10-1b3a-4f5d-9e6f-7g8h9i0j1k2l
status: experimental
description: Detects suspicious process execution initiated by web server services commonly associated with webshell activity or RCE exploitation.
references:
 - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2024/05/28
tags:
 - attack.initial_access
 - attack.t1190
 - attack.execution
 - attack.t1059.004
logsource:
 category: process_creation
 product: linux
detection:
 selection:
   ParentImage|endswith:
     - '/apache2'
     - '/httpd'
     - '/nginx'
     - '/php-fpm'
   Image|endswith:
     - '/bash'
     - '/sh'
     - '/perl'
     - '/python'
     - '/nc'
     - '/telnet'
   CommandLine|contains:
     - 'curl'
     - 'wget'
     - 'chmod'
     - 'chown'
 condition: selection
falsepositives:
 - Legitimate administrative scripts executed by web server (rare)
level: high
---
title: Suspicious Outbound Connection from Web Server
id: 9b5e3d21-2c4b-5g6h-0i7j-8k9l0m1n2o3p
status: experimental
description: Detects the web server process establishing a network connection to a non-standard port or external IP, typical of reverse shell activity.
references:
 - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2024/05/28
tags:
 - attack.command_and_control
 - attack.t1071
 - attack.t1059.001
logsource:
 category: network_connection
 product: linux
detection:
 selection:
   Image|endswith:
     - '/apache2'
     - '/httpd'
     - '/nginx'
   DestinationPort:
     - 4444
     - 5555
     - 6666
     - 31337
   Initiated: true
 condition: selection
falsepositives:
 - Legitimate outbound webhooks or API calls to non-standard ports
level: high

// Hunt for suspicious process executions spawned by common web services
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~("apache2", "httpd", "nginx", "php-fpm")
| where ProcessFileName in~("bash", "sh", "perl", "python", "nc", "wget", "curl")
| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessFileName, ProcessCommandLine, AccountName
| order by Timestamp desc


// Hunt for suspicious inbound traffic to Drupal endpoints followed by process creation
// (Requires correlation between web logs and endpoint logs)
Syslog
| where TimeGenerated > ago(24h)
| where ProcessName contains "apache" or ProcessName contains "nginx"
| where SyslogMessage contains "POST" and (SyslogMessage contains "/node/" or SyslogMessage contains "/user/")
| project TimeGenerated, ComputerName, ProcessName, SyslogMessage
| join kind=inner (
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where ProcessFileName in~("bash", "sh", "perl")
) on $left.ComputerName == $right.DeviceName

-- Hunt for suspicious child processes of web servers
SELECT Pid, Ppid, Name, Exe, CommandLine, Username
FROM pslist()
WHERE Ppid IN (
    SELECT Pid FROM pslist() WHERE Name =~ 'apache2'
       OR Name =~ 'httpd'
       OR Name =~ 'nginx'
       OR Name =~ 'php-fpm'
)
AND Name =~ 'bash'
   OR Name =~ 'sh'
   OR Name =~ 'perl'
   OR Name =~ 'python'
   OR Name =~ 'nc'

#!/bin/bash
# Drupal CVE-2024-33411 Remediation & Verification Script
# Run as root or a user with sudo privileges.

echo "[*] Checking Drupal Core version..."

# Common Drupal locations. Adjust DRUPAL_ROOT if installed elsewhere.
DRUPAL_ROOT="/var/www/html"

if [ -d "$DRUPAL_ROOT" ]; then
    cd "$DRUPAL_ROOT" || exit
    
    # Check if drush is available
    if command -v drush &> /dev/null; then
        VERSION=$(drush status --field=drupal-version)
        echo "[+] Current Drupal Version: $VERSION"
        
        # Check against patched versions (Simplified logic for example)
        # 10.2.7+, 10.3.1+, 11.0.1+
        
        # Logic: Extract major/minor/patch and compare
        # For automation, typically rely on 'composer update' or 'drush up'
        echo "[*] Checking for vulnerabilities via Drush..."
        drush security
        
        echo "[!] To remediate, run the following commands manually as an appropriate user:"
        echo "    composer require drupal/core-recommended:^10.2.7 --update-with-all-dependencies"
        echo "    OR"
        echo "    drush up"
        
    else
        echo "[-] Drush not found. Attempting to check core/lib/Drupal.php..."
        if [ -f "core/lib/Drupal.php" ]; then
            grep "const VERSION" core/lib/Drupal.php
        else
            echo "[-] Could not find Drupal core files."
        fi
    fi
else
    echo "[-] Drupal root not found at $DRUPAL_ROOT. Please update the script path."
fi

echo "[*] Scanning for recently modified PHP files (Potential Webshells)..."
find "$DRUPAL_ROOT" -type f -name "*.php" -mtime -1 -ls

echo "[*] Remediation Script Complete."