Apache HTTP Server is an open-source web server whose access events record HTTP requests, status codes, paths, methods, timestamps, and user agents. These fields support threat hunting for suspicious uploads and web requests. section 4.2.1
A practical Apache investigation workflow:
- Collect raw access logs from /var/log/apache2/access.log and parse them as access_combined events in a central data store. section 4.2.1
- Search successful requests for filenames and suspicious upload-directory paths, then sort results chronologically. section 4.2.1
- Decode URL-encoded and Base64 query values to expose commands embedded in request paths. section 4.2.1
Malicious upload investigation
Requests to a WordPress plugin upload directory accessed project-plan.php with encoded parameters. Decoding revealed whoami, download commands using wget or curl, netcat activity, and execution of a downloaded file. section 4.2.1
Listing 4.2 Sample Apache2 web access event in JSON format
{
"@timestamp": "2021-12-31T07:05:54.000Z",
"date": "31/Dec/2021:07:05:54",
"host": {
"name": "portal" #1
},
"index": "default",
"ip": "10.76.2.1", #2
"length": "9637", #3
"path": "/wp-admin/ HTTP/1.1", #4
"remote_log_name": "-",
"request_method": "GET", #5
"source": "/var/log/access.log", #6
"sourcetype": "access_combined", #7
"status": "200", #8
"timezone": "+0000",
"user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)
AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.1
Safari/605.1.15", #9
"userid": "-"
}
Inspect a parsed Apache access event and its timestamp, path, request method, source, status, and user-agent fields. section 4.2.1
