ShellSweep

ShellSweeping the evil

Why ShellSweep

"ShellSweep" is a PowerShell/Python/Lua tool designed to detect potential web shell files in a specified directory.

ShellSheep and it's suite of tools calculate the entropy of file contents to estimate the likelihood of a file being a web shell. High entropy indicates more randomness, which is a characteristic of encrypted or obfuscated codes often found in web shells.

• It only processes files with certain extensions (.asp, .aspx, .asph, .php, .jsp), which are commonly used in web shells.
• Certain directories can be excluded from scanning.
• Files with certain hashes can be ignored during the scan.

How does ShellSweep find the shells?

Entropy, in the context of information theory or data science, is a measure of the unpredictability, randomness, or disorder in a set of data. The concept was introduced by Claude Shannon in his 1948 paper "A Mathematical Theory of Communication".

When applied to a file or a string of text, entropy can help assess the randomness of the data. Here's how it works: If a file consists of completely random data (each byte is just as likely to be any value between 0 and 255), the entropy is high, close to 8 (since log2(256) = 8).

If a file consists of highly structured data (for example, a text file where most bytes are ASCII characters), the entropy is lower. In the context of finding web shells or malicious files, entropy can be a useful indicator:

• Many obfuscated scripts or encrypted payloads can have high entropy because the obfuscation or encryption process makes the data look random.
• A normal text file or HTML file would generally have lower entropy because human-readable text has patterns and structure (certain letters are more common, words are usually separated by spaces, etc.). So, a file with unusually high entropy might be suspicious and worth further investigation. However, it's not a surefire indicator of maliciousness -- there are plenty of legitimate reasons a file might have high entropy, and plenty of ways malware might avoid causing high entropy. It's just one tool in a larger toolbox for detecting potential threats.

ShellSweep includes a Get-Entropy function that calculates the entropy of a file's contents by:

• Counting how often each character appears in the file.
• Using these frequencies to calculate the probability of each character.
• Summing -p*log2(p) for each character, where p is the character's probability. This is the formula for entropy in information theory.

Why ShellSweepX?

ShellSweepX takes the core functionality of ShellSweep to the next level, offering several advantages over traditional EDR (Endpoint Detection and Response) solutions:

1. Specialized Focus: Unlike EDR solutions that cast a wide net, ShellSweepX is specifically designed to detect web shells. This specialized focus allows for more accurate and efficient detection of these particular threats.

2. Low Resource Overhead: ShellSweepX is lightweight and doesn't require constant background processes or system monitoring, unlike many EDR solutions. This means less impact on system performance.

3. Customizable and Transparent: The open-source nature of ShellSweepX allows for full transparency in its detection methods. You can easily customize and fine-tune the detection parameters to suit your specific environment.

4. No Dependency on External Services: ShellSweepX operates locally without relying on cloud-based analysis or constant updates, ensuring your sensitive data stays within your control.

5. Multi-layered Detection: ShellSweepX employs various detection methods including entropy analysis, pattern matching, and heuristic analysis, providing a comprehensive approach to web shell detection.

6. Detailed Reporting: ShellSweepX provides in-depth information about potential threats, including entropy values, detection methods, and confidence scores, allowing for more informed decision-making.

7. Cross-Platform Compatibility: With versions available in PowerShell, Python, and Lua, ShellSweepX can be deployed across various environments.

While ShellSweepX is not a replacement for a full-fledged EDR solution, it serves as a powerful, specialized tool in your security arsenal, particularly for environments where web shells pose a significant threat.

Feature Comparison