title: Program Started by the Web Server User (auditd)
id: e9d7b0f0-724e-4a24-8490-15d4646d39cb
status: test
description: |
    Detects a program started by the web server user (user id 33 on Debian and Ubuntu, 48 on RHEL), the shape of a web shell running a command after a PHP multipart upload exploit.
    Needs the CyRay auditd rule lines shown on the page loaded on the host. It matches the tag the rule writes (the key). Fired on real lab auditd records on 2026-10-22 (evaluated offline with pySigma): every positive event matched, and the audit-rule reload records matched nothing. Fired on the old tag only; since 2026-10-23 the rule lists the new `cyray-` tag as well (auditd Distribution 1.0.3), and that list change was first checked on 2026-10-24. It tests only the record type and the tag, so the web server user scoping lives in the auditd rule lines. On 2026-10-24 the lab matched this rule on records with decoded two-key fields (9 of 254 records), using its own evaluator, not a SIEM.
references:
    - https://cyray.io/attack-to-detection/t1190-php2shell-php-multipart-rce
author: CyRay
date: 2026-10-22
modified: 2026-10-22
tags:
    - attack.initial-access
    - attack.t1190
    - attack.execution
    - attack.t1059.004
logsource:
    product: linux
    service: auditd
detection:
    selection:
        type: 'SYSCALL'
        key:
            - 'cyray-webshell'
            - 'atl-webshell'
    condition: selection
falsepositives:
    - Web applications that legitimately shell out to helpers such as image converters or PDF tools
    - Scheduled jobs run as the web server user
level: medium