name: Web Remote ShellServlet Access
id: c2a332c3-24a2-4e24-9455-0e80332e6746
version: 1
date: '2023-11-22'
author: Michael Haag, Splunk
status: production
type: TTP
data_source:
- UPDATE_DATA_SOURCE
description: The following analytic identifies an attempt to access the Remote ShellServlet
  on a web server. This servlet is used to execute commands on the server. This activity
  is often associated with web shells and other malicious activity. This activity was identified against a Confluence server related to CVE-2023-22518 and CVE-2023-22515. Activity prior to access to the shell servlet include adding a plugin to Confluence. In addition, monitor for ShellServlet?act=3, ShellServlet or obfuscated variations including Sh3llServlet1.
search: '| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Web where Web.url IN ("*plugins/servlet/com.jsos.shell/*") Web.status=200 by Web.http_user_agent, Web.status Web.http_method, Web.url, Web.url_length, Web.src, Web.dest, sourcetype
  | `drop_dm_object_name("Web")` 
  | `security_content_ctime(firstTime)` 
  | `security_content_ctime(lastTime)` | `web_remote_shellservlet_access_filter`'
how_to_implement: The following analytic requires collection of Web data. The data can be collected via Splunk Stream, or by using the Splunk Add-on for Apache Web Server. The analytic does not require any additional configuration.
known_false_positives: False positives may be present based on the web server configuration. If the web server is configured to use the Remote ShellServlet, then this analytic will not be a true positive.
references:
- http://www.servletsuite.com/servlets/shell.htm
tags:
  analytic_story:
  - CVE-2023-22515 Privilege Escalation Vulnerability Confluence Data Center and Server
  asset_type: web server
  atomic_guid: []
  confidence: 90
  impact: 90
  message: An attempt to access the Remote ShellServlet on a web server was detected. The source IP is $src$ and the destination hostname is $dest$.
  mitre_attack_id:
  - T1190
  observable:
  - name: src
    type: IP Address
    role:
    - Attacker
  - name: dest
    type: Hostname
    role:
    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  risk_score: 81
  required_fields:
  - Web.http_user_agent
  - Web.status
  - Web.http_method
  - Web.url
  - Web.url_length
  - Web.src
  - Web.dest
  - sourcetype
  security_domain: network
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/confluence/shellservlet.log
    source: aws
    sourcetype: aws:cloudfront:accesslogs