[New Rule] Webshell Deployed via Apache Struts CVE-2023-50164 Exploitation

Fixes #5344

Author: terrancedejesus

rules/linux/initial_access_apache_struts_cve_2023_50164_exploitation_to_webshell.toml

@@ -0,0 +1,112 @@
+[metadata]
+creation_date = "2025/11/19"
+integration = ["endpoint", "network_traffic"]
+maturity = "production"
+updated_date = "2025/11/19"
+
+[rule]
+author = ["Elastic"]
+description = """
+Identifies successful exploitation of CVE-2023-50164, a critical path traversal vulnerability in Apache Struts 2 file
+upload functionality. This high-fidelity rule detects a specific attack sequence where a malicious multipart/form-data
+POST request with WebKitFormBoundary is made to a Struts .action upload endpoint, immediately followed by the creation
+of a JSP web shell file by a Java process in Tomcat's webapps directories. This correlated activity indicates active
+exploitation resulting in remote code execution capability through unauthorized file upload and web shell deployment.
+"""
+false_positives = [
+    """
+    False positives are expected to be very rare due to the specific nature of this rule. Legitimate application
+    deployments typically do not involve multipart form uploads to .action endpoints followed immediately by JSP file
+    creation in webapps directories. However, custom deployment scripts or automated testing tools that simulate file
+    uploads could potentially trigger this alert. Review the source IP, user agent, uploaded file content, timing, and
+    deployment schedules to validate if the activity is authorized. Standard package manager operations are already
+    excluded from detection.
+    """,
+]
+from = "now-9m"
+index = ["logs-endpoint.events.*", "logs-network_traffic.*"]
+language = "eql"
+license = "Elastic License v2"
+name = "Potential Webshell Deployed via Apache Struts CVE-2023-50164 Exploitation"
+references = [
+    "https://nvd.nist.gov/vuln/detail/CVE-2023-50164",
+    "https://www.trendmicro.com/en_us/research/23/l/decoding-cve-2023-50164--unveiling-the-apache-struts-file-upload.html",
+    "https://cwiki.apache.org/confluence/display/WW/S2-066",
+    "https://attack.mitre.org/techniques/T1505/003/",
+]
+risk_score = 73
+rule_id = "7f3e8b9a-2c4d-5e6f-8a1b-9c2d3e4f5a6b"
+setup = """## Setup
+
+This rule requires data coming in from both Elastic Defend (for file events) and Network Packet Capture integrations (for HTTP traffic analysis).
+
+### Network Packet Capture Integration Setup
+
+**IMPORTANT**: This rule requires HTTP request body capture to be enabled in order to detect the multipart/form-data content containing WebKitFormBoundary indicators. The network traffic integration must be configured to capture HTTP request bodies for POST requests with `multipart/form-data` content type.
+"""
+severity = "high"
+tags = [
+    "Domain: Endpoint",
+    "Domain: Web",
+    "Domain: Network",
+    "OS: Linux",
+    "Use Case: Threat Detection",
+    "Tactic: Initial Access",
+    "Tactic: Persistence",
+    "Data Source: Elastic Defend",
+    "Data Source: Network Traffic",
+    "Vulnerability: CVE-2023-50164",
+]
+type = "eql"
+
+query = '''
+sequence by agent.id with maxspan=10s
+[network where data_stream.dataset == "network_traffic.http" and
+    http.request.method == "POST" and
+    http.request.body.content like "*WebKitFormBoundary*" and
+    url.path like "*upload*.action"]
+[file where event.dataset == "endpoint.events.file" and
+    host.os.type == "linux" and
+    event.action == "creation" and
+    process.name == "java" and
+    (file.path like "/opt/tomcat/webapps/*" or
+    file.path like "*/tomcat*/webapps/*" or
+    file.path like "*/catalina/webapps/*" or
+    file.path like "*/webapps/ROOT/*" or
+    file.path like "*/webapps/*/") and
+    file.extension == "jsp" and
+    not file.path like "*/WEB-INF/*" and
+    not file.path like "*/META-INF/*" and
+    not process.parent.name in ("apt", "apt-get", "dpkg", "yum", "rpm", "dnf", "systemd", "init")]
+'''
+
+
+[[rule.threat]]
+framework = "MITRE ATT&CK"
+[[rule.threat.technique]]
+id = "T1190"
+name = "Exploit Public-Facing Application"
+reference = "https://attack.mitre.org/techniques/T1190/"
+
+
+[rule.threat.tactic]
+id = "TA0001"
+name = "Initial Access"
+reference = "https://attack.mitre.org/tactics/TA0001/"
+
+[[rule.threat]]
+framework = "MITRE ATT&CK"
+[[rule.threat.technique]]
+id = "T1505"
+name = "Server Software Component"
+reference = "https://attack.mitre.org/techniques/T1505/"
+[[rule.threat.technique.subtechnique]]
+id = "T1505.003"
+name = "Web Shell"
+reference = "https://attack.mitre.org/techniques/T1505/003/"
+
+
+[rule.threat.tactic]
+id = "TA0003"
+name = "Persistence"
+reference = "https://attack.mitre.org/tactics/TA0003/"