Detects a highly relevant Antivirus alert that reports a web shell. It's highly recommended to tune this rule to the specific strings used by your anti virus solution by downloading a big WebShell repository from e.g. github and checking the matches.

Read More

Detects a write of an Exchange CSR to an untypical directory or with aspx name suffix which can be used to place a webshell

Read More

Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells

Read More

Detects an authentication bypass vulnerability affecting the REST API URLs in ADSelfService Plus (CVE-2021-40539).

Read More

Detects access to DEWMODE webshell as described in FIREEYE report

Read More

Rule to detect an adversary setting OabVirtualDirectory External URL property to a script in Exchange Management log

Read More

Detects suspicious IIS native-code module installations via command line

Read More

Detects suspicious sub processes of web server processes

Read More

Detects a successful export of an Exchange mailbox to untypical directory or with aspx name suffix which can be used to place a webshell or the needed role assignment for it

Read More

Detects get requests to specific files used during the exploitation of MOVEit CVE-2023-34362

Read More

Detects access to a webshell dropped into a keystore folder on the WebLogic server

Read More

Detects the creation of files with certain extensions on a static web site. This can be indicative of potential uploads of a web shell.

Read More

Detects attempts to exploit a Rejetto HTTP File Server (HFS) via CVE-2014-6287

Read More

Detects shellshock expressions in log files

Read More

Detects access to SUPERNOVA webshell as described in Guidepoint report

Read More

Detects suspicious file type dropped by an Exchange component in IIS into a suspicious folder

Read More

Detects suspicious child processes of the SQLServer process. This could indicate potential RCE or SQL Injection.

Read More

Detects suspicious file type dropped by an Exchange component in IIS

Read More

Detects suspicious activity in which the MSExchangeMailboxReplication process writes .asp and .apsx files to disk, which could be a sign of ProxyShell exploitation

Read More

Detects potentially suspicious processes being spawned by a web server process which could be the result of a successfully placed web shell or exploitation

Read More

Detects suspicious Windows strings in URI which could indicate possible exfiltration or webshell communication

Read More

Detects certain command line parameters often used during reconnaissance activity via web shells

Read More

Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system

Read More

Certain strings in the uri_query field when combined with null referer and null user agent can indicate activity associated with the webshell ReGeorg.

Read More

Detects possible command execution by web application/web shell

Read More

Detects processes spawned from web servers (PHP, Tomcat, IIS, etc.) that perform reconnaissance looking for the existence of popular scripting tools (perl, python, wget) on the system via the help commands

Read More

Detects common commands used in Windows webshells

Read More

These commands were used to create a webshell by exploiting ProxyShell vulnerabilities

Read More

Detection of a webshell in a ManageEngine internet accessible directory.

Read More