Web servers

Kind

State - something true when Signal read the host

Built-in rules reading it

0

web.server

string

The web server: IIS, Apache httpd, nginx or Apache Tomcat.

web.version

string

The server's version: IIS's from its own registry key, the others' from their program's version resource; absent when neither records one.

web.site

string

The site: IIS's site name, or the configuration file and server name a document root is declared under for the other servers.

web.bindings

string

Where the site listens, as its configuration declares it: protocol, address, port and host name for IIS; the Listen / listen directives and Tomcat's connectors otherwise. Configured, not proof that the port is open now.

web.roots

string

The folders the site serves: each application or virtual directory's URL path and its physical folder ("/ = C:\inetpub\wwwroot"), separated by "; ".

web.pool

string

IIS: the application pools the site's applications run in, with their .NET runtime and pipeline mode.

web.identity

string

The account the site's code runs as - IIS's pool identity (ApplicationPoolIdentity, NetworkService, LocalSystem, a named account), the service's account for the other servers. Code a webshell runs, runs as this account; LocalSystem is the computer itself.

web.holds

string

What the site's files are, by the server-side script types found (ASP.NET, classic ASP, PHP, Java, ColdFusion) and the products recognised by their folders (Microsoft Exchange, SharePoint); "static files only" when no script was found.
derived: counted by Signal from the walk of the site's folders

web.files

string

How much of the site was examined: the files walked, the server-side scripts among them, and whether the walk stopped at its limit (the rest not examined).

web.last_deployment

time

The newest time five or more of the site's files were written within ten minutes - its last deployment or update, as the files' times record it. Absent when no such batch was found.
derived: computed by Signal from the files' modification times

web.newest_script

string

The server-side script written most recently, with its modification time.

web.logs

string

The site's request log folder as configured (IIS), and the newest log file in it.

web.running

string

The server's processes running when Signal read the process table - an IIS pool's worker (w3wp.exe, named by its pool) or the server's program - with PID, account and start time. Absent when none ran: IIS starts a pool's worker on its first request.

web.flagged

string

How many of the site's scripts carry a webshell's indicators, by confidence.

web.detections

string

The antivirus's detections of files in the site's folders: the threat, the file, when, and what the product did.

web.sources

string

Every place that records the server or the site, separated by "; ".

Kind

State - something true when Signal read the host

Built-in rules reading it

3

web.server

string

The web server: IIS, Apache httpd, nginx or Apache Tomcat.

web.site

string

The site: IIS's site name, or the configuration file and server name a document root is declared under for the other servers.

web.file

string

The script's full path.

web.url

string

The URL path the script is served at, from the site's roots - what a request for it names in the request log.
derived: mapped by Signal from web.roots

web.file_size

int

The script's size in bytes.

web.file_created

time

When the file was created at this path, as the file system records it (a copy is created when it is copied; the time can be changed by whoever can write the file).

web.file_modified

time

When the file's content was last written, as the file system records it (a copy keeps its source's; the time can be changed by whoever can write the file).

web.indicators

string

Each webshell indicator the script carries, separated by "; ": where it was placed, when it was written, its attributes, the requests the request log records for it, the antivirus's detection - its content is not read.
derived: assessed by Signal from the file's place, times and attributes and IIS's request log (providers/web); the antivirus's detection and the period added by the Webshells module

web.confidence

string

How strongly the indicators together point to a webshell: high, medium or low - an assessment for triage, not a verdict; frameworks and administration tools carry some of the same indicators.
derived: combined by Signal from web.indicators (evidence.WebConfidence): high - the antivirus detected it, a disguised name, or three or more indicators; medium - two, or a hidden or system attribute; low - one

web.requests

string

The requests for the script in the newest part of the site's request log Signal read (IIS): how many, by method and status, from which client addresses, first and last - with the span read. None found is "none in the part read", never "never requested".

web.in_period

bool

true when the script was created or written inside the period the analyst gave (the profile's window); absent when no period was given.
derived: set by Signal from web.file_created, web.file_modified and the since parameter

Kind

State - something true when Signal read the host

Built-in rules reading it

2

web.server

string

The web server: IIS, Apache httpd, nginx or Apache Tomcat.

web.site

string

The site: IIS's site name, or the configuration file and server name a document root is declared under for the other servers.

web.module_kind

string

native module (a DLL IIS loads into every worker) or handler (a mapping that says what runs a request for a path).

web.module_name

string

The module's or the handler's name, as configured.

web.module_image

string

What it runs: a native module's DLL; a handler's modules, type and script processor.

web.module_path

string

The request path a handler serves ("*.aspx", "*.jpg").

web.module_runs_code

bool

true when the handler runs server-side code: ISAPI, CGI or FastCGI, or an ASP.NET page, handler or service factory.
derived: decided by Signal from the handler's modules, type and script processor

web.module_location

string

Where a native module's DLL is: IIS's folder (System32\inetsrv, SysWOW64\inetsrv), the .NET Framework's folder, Program Files, or elsewhere.

file.signer

string

Who signed the entry's program: the name on the signing certificate (Microsoft Windows, Microsoft Corporation, a vendor), from the file's own signature or the Windows catalog that lists it. Empty when unsigned or not checked.
derived: verified by Signal with WinVerifyTrust (embedded signature, else the system catalogs)

file.signature

string

The program's signature: valid, invalid (signed, but the signature or its chain does not verify), unsigned, or not found (no such file). Absent when it could not be checked.
derived: verified by Signal (as file.signer)

web.module_declared

string

The configuration file that declares it, and the location path inside it when it applies to one site or folder only.