Google GTIG: AI-Generated Zero-Day Exploits Targeting Open-Source Web Admin Tools

---
title: Potential Web Shell Activity via Admin Tool Spawning Shell
id: 9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects when a common web administration or server process spawns a shell (bash/sh), indicating potential RCE or web shell activation. 
references:
  - https://cloud.google.com/security-advisory
author: Security Arsenal
date: 2025/04/10
tags:
  - attack.execution
  - attack.t1059.004
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/apache2'
      - '/httpd'
      - '/nginx'
      - '/python' # Common for python-based admin tools like Cockpit/Supervisor
      - '/webmin'
      - '/perl' # Common for CGI-based tools
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/zsh'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate administrative scripts executed by developers
  - Legacy CGI scripts utilizing system shells
level: high
---
title: Suspicious Outbound Connection from Web Admin Process
id: 1b2c3d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects established network connections initiated by common web server or admin tool binaries to non-standard ports, typical of reverse shells.
references:
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2025/04/10
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.t1059
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|endswith:
      - '/apache2'
      - '/httpd'
      - '/nginx'
      - '/webmin'
      - '/python'
    DestinationPort|notin:
      - 80
      - 443
      - 8080
      - 8443
  condition: selection
falsepositives:
  - Legitimate outbound API calls to custom ports
  - Administrative updates to third-party services
level: medium

let WebProcesses = dynamic(["apache2", "httpd", "nginx", "webmin", "python", "perl"]);
let ShellProcesses = dynamic(["bash", "sh", "dash", "zsh"]);
DeviceProcessEvents
| where InitiatingProcessFileName in~ WebProcesses
| where FileName in~ ShellProcesses
| join (
    DeviceNetworkEvents
    | where InitiatingProcessFileName in~ WebProcesses
    | where RemotePort notin (80, 443, 8080, 53)
) on DeviceId, InitiatingProcessFileName
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, RemoteIP, RemotePort, RemoteUrl
| summarize count() by Timestamp, DeviceName, RemoteIP

-- Hunt for Web Admin Tools Spawning Shells
SELECT 
  Pid AS ChildPid,
  Name AS ChildName,
  CommandLine AS ChildCmd,
  Parent.Pid AS ParentPid,
  Parent.Name AS ParentName,
  Parent.CommandLine AS ParentCmd,
  Username,
  StartTime
FROM pslist()
WHERE Parent.Name =~ '(apache|httpd|nginx|webmin|python|perl)'
  AND Name =~ '(bash|sh|dash|zsh)'

#!/bin/bash

# Web Admin Tool Hardening & Audit Script
# Usage: sudo ./audit_web_admin.sh

echo "[+] Auditing for active Web Admin Tools (Webmin, Cockpit, Ajenti, etc)..."

# Check for common web admin processes
ADMIN_PROCS=$(ps aux | grep -E 'webmin|cockpit|ajenti|cpanel' | grep -v grep)

if [ -z "$ADMIN_PROCS" ]; then
    echo "[-] No common Web Admin Tool processes detected."
else
    echo "[!] WARNING: Active Web Admin Tool processes found:"
    echo "$ADMIN_PROCS"
    echo ""
    echo "[+] Recommendation: Restrict access to these ports via firewall."
fi

echo ""
echo "[+] Checking for suspicious files in /var/www and /tmp (modified in last 24h)..."

# Find files modified in last 24 hours that contain common webshell keywords
find /var/www /tmp -type f -mtime -1 -exec grep -l -E 'eval\(|base64_decode|shell_exec|passthru|system\(' {} \; 2>/dev/null | while read file; do
    echo "[!] SUSPICIOUS FILE FOUND: $file"
    ls -la "$file"
done

echo ""
echo "[+] Firewall Hardening Recommendation:"
echo "Ensure access to Web Admin Ports (e.g., 10000, 9090) is restricted to trusted IPs."
echo "Example for iptables (restricting Webmin port 10000 to Management IP 192.168.1.50):"
echo "  iptables -A INPUT -p tcp -s 192.168.1.50 --dport 10000 -j ACCEPT"
echo "  iptables -A INPUT -p tcp --dport 10000 -j DROP"

echo "[+] Audit complete."