Web shell: recurring POSTs to rare URIs
A web shell gives itself away through repeated POSTs to a specific script, from very few IPs, almost always returning 200 — the exact opposite of a public form.
Prerequisites
Elasticsearch 8.12+, access logs ECS
SQL
FROM "logs-web-*"
| WHERE http.request.method == "POST"
AND @timestamp >= NOW() - 7 days
AND url.path RLIKE ".*\\.(php|jsp|aspx)"
| STATS
posts = COUNT(*),
clients = COUNT_DISTINCT(source.ip),
succes = COUNT(*) WHERE http.response.status_code == 200,
agents = COUNT_DISTINCT(user_agent.original)
BY url.path
| WHERE clients <= 2 AND posts > 50
| EVAL taux_succes_pct = ROUND(100.0 * succes / posts, 1)
| SORT posts DESC
| LIMIT 20Result
url.path | posts | clients | succes | agents | taux_succes_pct --------------------------+-------+---------+--------+--------+---------------- /media/cache/thumb_gen.php| 1842 | 1 | 1840 | 1 | 99.9 /old/wp-info.php | 412 | 2 | 409 | 2 | 99.3 /api/legacy/upload.aspx | 88 | 1 | 84 | 1 | 95.5
SOCWeb shellHTTPDétection