title: Outbound Connection by the Web Server User (auditd)
id: 0d1f4792-f38e-4c8b-b12a-44eab31f6d00
status: test
description: |
    Detects a network connection made by the web server user. PHP itself rarely connects out; a reverse shell started from a web shell does.
    Needs the CyRay auditd rule lines shown on the page loaded on the host. It matches the tag the rule writes (the key). Fired on real lab auditd records on 2026-10-22 (evaluated offline with pySigma): every positive event matched, and the audit-rule reload records matched nothing. Fired on the old tag only; since 2026-10-23 the rule lists the new `cyray-` tag as well (auditd Distribution 1.0.3), and that list change was first checked on 2026-10-24. It tests only the record type and the tag, so the web server user scoping lives in the auditd rule lines. On 2026-10-24 the lab matched this rule on records with decoded two-key fields (3 of 254 records), using its own evaluator, not a SIEM.
references:
    - https://cyray.io/attack-to-detection/t1190-php2shell-php-multipart-rce
author: CyRay
date: 2026-10-22
modified: 2026-10-22
tags:
    - attack.initial-access
    - attack.t1190
    - attack.command-and-control
    - attack.t1071
logsource:
    product: linux
    service: auditd
detection:
    selection:
        type: 'SYSCALL'
        key:
            - 'cyray-webshell-connect'
            - 'atl-webshell-connect'
    condition: selection
falsepositives:
    - Applications that call external APIs, send mail or fetch feeds from PHP code
    - Local connections to a database or cache; filter those by destination
level: medium