Joomla iCagenda & Balbooa Forms — Unauthenticated File-Upload RCE

Looks for: httpd/apache2/php-fpm/nginx/w3wp spawning an interactive shell or recon/download LOLBin — the webshell running commands. Highest-fidelity signal in the pack. FP: some PHP apps legitimately shell out (imagemagick, backups) — baseline per host and exclude known helper commands.

// HUNT: web-server process spawning a shell/LOLBin (webshell execution)
// MITRE: T1059, T1505.003 | CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2
// FALSE POSITIVES: PHP apps invoking convert/backup helpers
// TUNING: exclude known helper FileName per host baseline
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^(httpd|apache2|php-fpm[0-9.]*|php|nginx|w3wp|caddy|litespeed)(\.exe)?$/i
| FileName=/^(sh|bash|dash|zsh|cmd|powershell|pwsh|whoami|id|uname|python[0-9.]*|perl|curl|wget|nc|ncat|socat)(\.exe)?$/i
| table([ComputerName, aid, UserName, FileName, ParentBaseFileName, CommandLine], limit=200)

Looks for: a script file (.php/.phtml/.phar) written under the iCagenda or Balbooa upload paths — the webshell being planted. FP: legitimate extension updates can write files to images subfolders — a script extension in an uploads/attachments folder is not legitimate. Requires file-write telemetry on the host.

// HUNT: PHP webshell written to iCagenda/Balbooa upload directory
// MITRE: T1505.003 | CONF: high  FP: med  COST: low | REQUIRES: file-write telemetry (TargetFileName)
// FALSE POSITIVES: extension update writing to images/ — but never a script in uploads/attachments
// TUNING: keep only .php/.phtml/.phar extensions; scope to the two known dirs
#event_simpleName=/PeFileWritten|NewExecutableWritten|FileCreateInfo/
| TargetFileName=/(icagenda.{0,40}attachments|baforms.{0,20}uploads).{0,60}\.(php|phtml|phar|php5|php7)/i
| table([ComputerName, aid, UserName, TargetFileName, ContextBaseFileName], limit=200)

Looks for: host/user/network discovery utilities whose parent is a web-server process — hands-on-keyboard recon through the shell. FP: monitoring agents occasionally spawn these — exclude known monitoring parents/accounts.

// HUNT: discovery utilities parented by a web-server process
// MITRE: T1083, T1087, T1082, T1016 | CONF: med  FP: med  COST: low | REQUIRES: ProcessRollup2
// FALSE POSITIVES: monitoring/inventory agents
// TUNING: exclude monitoring service accounts and known agent parents
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^(httpd|apache2|php-fpm[0-9.]*|php|nginx|w3wp|litespeed)(\.exe)?$/i
| FileName=/^(whoami|id|uname|hostname|net1?|systeminfo|ipconfig|ifconfig|arp|cat|ls|dir)(\.exe)?$/i
| table([ComputerName, aid, UserName, FileName, ParentBaseFileName, CommandLine], limit=200)

Looks for: curl/wget/certutil/python fetching a second stage, parented by the web server. FP: some apps fetch remote resources — require an external URL and correlate with Q1/Q2.

// HUNT: ingress tool transfer parented by a web-server process
// MITRE: T1105 | CONF: high  FP: med  COST: low | REQUIRES: ProcessRollup2
// FALSE POSITIVES: apps legitimately fetching remote assets
// TUNING: require external URL in CommandLine; exclude package-manager parents
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^(httpd|apache2|php-fpm[0-9.]*|php|nginx|w3wp|litespeed)(\.exe)?$/i
| CommandLine=/(curl\s.{0,40}http|wget\s.{0,40}http|certutil.{0,30}urlcache|Invoke-WebRequest|DownloadString)/i
| table([ComputerName, aid, UserName, FileName, ParentBaseFileName, CommandLine], limit=200)

Looks for: reverse-shell one-liners and tunnel binaries (nc/ncat/socat, bash -i, python socket, ngrok/chisel) run on the web host — attacker upgrading the webshell to interactive access.

// HUNT: reverse shell / tunneling from the web host
// MITRE: T1059, T1572, T1071 | CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2
// FALSE POSITIVES: sanctioned admin tunnels — confirm operator + change record
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| CommandLine=/(bash\s+-i|sh\s+-i|nc\s.{0,20}-e|ncat\s.{0,20}-e|socat\s.{0,30}exec|python[0-9.]*\s.{0,60}socket|ngrok|chisel|frpc)/i
| table([ComputerName, aid, UserName, FileName, ParentBaseFileName, CommandLine], limit=200)

Looks for: crontab/systemctl/schtasks/at run by a web-server process — persistence installed via the webshell. FP: deployment tooling can install cron/services — exclude known deploy accounts and RMM parents.

// HUNT: cron/task persistence installed via a web-server process
// MITRE: T1053.003, T1053.005, T1543 | CONF: med  FP: med  COST: low | REQUIRES: ProcessRollup2
// FALSE POSITIVES: CI/CD or config-management deployment
// TUNING: exclude deployment/config-management accounts and parents
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^(httpd|apache2|php-fpm[0-9.]*|php|nginx|w3wp|litespeed)(\.exe)?$/i
| FileName=/^(crontab|systemctl|schtasks|at|systemd-run)(\.exe)?$/i
| table([ComputerName, aid, UserName, FileName, ParentBaseFileName, CommandLine], limit=200)

Looks for: the web-server process itself connecting outbound — reverse-shell egress or C2. FP: web apps make legitimate outbound API/update calls — treat as a pivot, rank by rare destination, never alert alone.

// HUNT: outbound connection sourced from a web-server process
// MITRE: T1071, T1571 | CONF: med  FP: high  COST: med | REQUIRES: NetworkConnectIP4
// FALSE POSITIVES: legitimate outbound API/update calls
// TUNING: allowlist known API/update destinations; focus on rare RemoteAddressIP4
#event_simpleName=/NetworkConnectIP4/
| ConnectionDirection="0"
| ContextBaseFileName=/^(httpd|apache2|php-fpm[0-9.]*|php|nginx|w3wp|litespeed)(\.exe)?$/i
| groupBy([RemoteAddressIP4, RemotePort, ContextBaseFileName], function=count(field=ComputerName, as=hosts, distinct=true))
| table([RemoteAddressIP4, RemotePort, ContextBaseFileName, hosts], limit=200)