This query is designed to detect potential webshell activity on Linux systems by monitoring specific process events. Here's a simplified summary:

1. Purpose: The query aims to identify suspicious activities that might indicate the presence of a webshell, a malicious script used to control a web server.

2. How It Works:

   • Monitors Process Events: It looks at events where processes are executed.
   • Filters for Web Server Processes: It focuses on processes initiated by common web server software like httpd, nginx, apache2, etc.
   • Checks for System Administration Tools: It then checks if these web server processes are executing common system administration commands like whoami, ifconfig, uname, etc.

3. Exclusions:

   • Specific Process Exclusion: It excludes events where the initiating process is calico-node.
   • Command Line Exclusion: It also excludes events where the command line includes cat /proc/cpuinfo.

4. Tags: The query is tagged for webshell detection, process events, and Linux, indicating its focus areas.

Search Query Breakdown:

DeviceProcessEvents
| where InitiatingProcessFileName has_any ("httpd", "lighttpd", "nginx", "apache2", "node", "caddy")
| where FileName has_any ("whoami", "ifconfig", "ip", "uname", "cat", "crontab", "hostname", "iptables", "netstat", "pwd", "route")
| where InitiatingProcessFileName !contains "calico-node"
| where ProcessCommandLine !contains "cat /proc/cpuinfo"

• First Line: Filters events to include only those initiated by common web server processes.
• Second Line: Further filters to include only those events where the executed file is a common system administration tool.
• Third Line: Excludes events where the initiating process is calico-node.
• Fourth Line: Excludes events where the command line includes cat /proc/cpuinfo.

In essence, this query helps in identifying unusual activities that could suggest a webshell is being used to control the web server by executing system commands.