title: Write Under the Web Root (auditd)
id: 372ac081-aa76-44e0-b973-00b70161e996
status: test
description: |
    Detects a write or attribute change under /var/www or /var/www/html. A web shell or dropper written through a web flaw lands here.
    Needs the CyRay auditd rule lines shown on the page loaded on the host. It matches the tag the rule writes (the key). Fired on real lab auditd records on 2026-10-22 (evaluated offline with pySigma): every positive event matched, and the audit-rule reload records matched nothing. Fired on the old tag only; since 2026-10-23 the rule lists the new `cyray-` tag as well (auditd Distribution 1.0.3), and that list change was first checked on 2026-10-24. It tests only the record type and the tag, so the web server user scoping lives in the auditd rule lines. On 2026-10-24 the lab matched this rule on records with decoded two-key fields (5 of 254 records), using its own evaluator, not a SIEM.
references:
    - https://cyray.io/attack-to-detection/t1190-php2shell-php-multipart-rce
author: CyRay
date: 2026-10-22
modified: 2026-10-22
tags:
    - attack.initial-access
    - attack.t1190
    - attack.persistence
    - attack.t1505.003
logsource:
    product: linux
    service: auditd
detection:
    selection:
        type: 'SYSCALL'
        key:
            - 'cyray-webroot-write'
            - 'atl-webroot-write'
    condition: selection
falsepositives:
    - Deployments, CMS updates and uploads written by the application
    - Exclude your deploy user and known upload directories
level: medium