attack.t1505.003

Certain strings in the uri_query field when combined with null referer and null user agent can indicate activity associated with the webshell ReGeorg.

Windows Webshell Strings

Nov 24, 2025 · attack.persistence attack.t1505.003 ·

Share on:

Detects common commands used in Windows webshells

Rejetto HTTP File Server RCE

Oct 23, 2025 · attack.persistence attack.initial-access attack.t1190 attack.t1505.003 cve.2014-6287 detection.emerging-threats ·

Share on:

Detects attempts to exploit a Rejetto HTTP File Server (HFS) via CVE-2014-6287

Suspicious Process Spawned by CentreStack Portal AppPool

Oct 23, 2025 · attack.persistence attack.execution attack.t1059.003 attack.t1505.003 cve.2025-30406 detection.emerging-threats ·

Share on:

Detects unexpected command shell execution (cmd.exe) from w3wp.exe when tied to CentreStack's portal.config, indicating potential exploitation (e.g., CVE-2025-30406)

Commvault QOperation Path Traversal Webshell Drop (CVE-2025-57790)

Oct 20, 2025 · attack.persistence attack.t1505.003 detection.emerging-threats cve.2025-57790 ·

Share on:

Detects the use of qoperation.exe with the -file argument to write a JSP file to the webroot, indicating a webshell drop. This is a post-authentication step corresponding to CVE-2025-57790.

Suspicious File Write to Webapps Root Directory

Oct 20, 2025 · attack.persistence attack.t1505.003 attack.initial-access attack.t1190 ·

Share on:

Detects suspicious file writes to the root directory of web applications, particularly Apache web servers or Tomcat servers. This may indicate an attempt to deploy malicious files such as web shells or other unauthorized scripts.

IIS Native-Code Module Command Line Installation

Aug 28, 2025 · attack.persistence attack.t1505.003 ·

Share on:

Detects suspicious IIS native-code module installations via command line

Suspicious File Write to SharePoint Layouts Directory

Jul 28, 2025 · attack.initial-access attack.t1190 attack.persistence attack.t1505.003 ·

Share on:

Detects suspicious file writes to SharePoint layouts directory which could indicate webshell activity or post-exploitation. This behavior has been observed in the exploitation of SharePoint vulnerabilities such as CVE-2025-49704, CVE-2025-49706 or CVE-2025-53770.

Potential Java WebShell Upload in SAP NetViewer Server

Jun 11, 2025 · attack.persistence attack.t1505.003 detection.emerging-threats cve.2025-31324 ·

Share on:

Detects potential Java webshell uploads via HTTP requests with Content-Type 'application/octet-stream' and Java file extensions. This behavior might indicate exploitation of vulnerabilities like CVE-2025-31324, which allows remote code execution through webshells in SAP NetViewer.

Potential SAP NetViewer Webshell Command Execution

Jun 11, 2025 · attack.persistence attack.t1505.003 attack.initial-access attack.t1190 detection.emerging-threats cve.2025-31324 ·

Share on:

Detects potential command execution via webshell in SAP NetViewer through JSP files with cmd parameter. This rule is created to detect exploitation of vulnerabilities like CVE-2025-31324, which allows remote code execution via a webshell.

Suspicious Process By Web Server Process

Jun 4, 2025 · attack.persistence attack.initial-access attack.t1505.003 attack.t1190 ·

Share on:

Detects potentially suspicious processes being spawned by a web server process which could be the result of a successfully placed web shell or exploitation

Chopper Webshell Process Pattern

Apr 25, 2025 · attack.persistence attack.discovery attack.t1505.003 attack.t1018 attack.t1033 attack.t1087 ·

Share on:

Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells

Webshell Detection With Command Line Keywords

Apr 25, 2025 · attack.persistence attack.discovery attack.t1505.003 attack.t1018 attack.t1033 attack.t1087 ·

Share on:

Detects certain command line parameters often used during reconnaissance activity via web shells

Webshell Hacking Activity Patterns

Apr 25, 2025 · attack.persistence attack.discovery attack.t1505.003 attack.t1018 attack.t1033 attack.t1087 ·

Share on:

Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system

MOVEit CVE-2023-34362 Exploitation Attempt - Potential Web Shell Request

Jan 30, 2025 · attack.persistence attack.t1505.003 cve.2023-34362 detection.emerging-threats ·

Share on:

Detects get requests to specific files used during the exploitation of MOVEit CVE-2023-34362

Antivirus Web Shell Detection

Nov 4, 2024 · attack.persistence attack.t1505.003 ·

Share on:

Detects a highly relevant Antivirus alert that reports a web shell. It's highly recommended to tune this rule to the specific strings used by your anti virus solution by downloading a big WebShell repository from e.g. github and checking the matches. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Certificate Request Export to Exchange Webserver

Aug 12, 2024 · attack.persistence attack.t1505.003 ·

Share on:

Detects a write of an Exchange CSR to an untypical directory or with aspx name suffix which can be used to place a webshell

Exchange Set OabVirtualDirectory ExternalUrl Property

Aug 12, 2024 · attack.persistence attack.t1505.003 ·

Share on:

Rule to detect an adversary setting OabVirtualDirectory External URL property to a script in Exchange Management log

Linux Webshell Indicators

Aug 12, 2024 · attack.persistence attack.t1505.003 ·

Share on:

Detects suspicious sub processes of web server processes

Mailbox Export to Exchange Webserver

Aug 12, 2024 · attack.persistence attack.t1505.003 ·

Share on:

Detects a successful export of an Exchange mailbox to untypical directory or with aspx name suffix which can be used to place a webshell or the needed role assignment for it

Potential Webshell Creation On Static Website

Aug 12, 2024 · attack.persistence attack.t1505.003 ·

Share on:

Detects the creation of files with certain extensions on a static web site. This can be indicative of potential uploads of a web shell.

Shellshock Expression

Aug 12, 2024 · attack.persistence attack.t1505.003 ·

Share on:

Detects shellshock expressions in log files

Suspicious ASPX File Drop by Exchange

Aug 12, 2024 · attack.persistence attack.t1505.003 ·

Share on:

Detects suspicious file type dropped by an Exchange component in IIS into a suspicious folder

Suspicious Child Process Of SQL Server

Aug 12, 2024 · attack.t1505.003 attack.t1190 attack.initial-access attack.persistence attack.privilege-escalation ·

Share on:

Detects suspicious child processes of the SQLServer process. This could indicate potential RCE or SQL Injection.

Suspicious File Drop by Exchange

Aug 12, 2024 · attack.persistence attack.t1190 attack.initial-access attack.t1505.003 ·

Share on:

Detects suspicious file type dropped by an Exchange component in IIS

Suspicious MSExchangeMailboxReplication ASPX Write

Aug 12, 2024 · attack.initial-access attack.t1190 attack.persistence attack.t1505.003 ·

Share on:

Detects suspicious activity in which the MSExchangeMailboxReplication process writes .asp and .apsx files to disk, which could be a sign of ProxyShell exploitation

Suspicious Windows Strings In URI

Aug 12, 2024 · attack.persistence attack.exfiltration attack.t1505.003 ·

Share on:

Detects suspicious Windows strings in URI which could indicate possible exfiltration or webshell communication

Webshell Tool Reconnaissance Activity

Aug 12, 2024 · attack.persistence attack.t1505.003 ·

Share on:

Detects processes spawned from web servers (PHP, Tomcat, IIS, etc.) that perform reconnaissance looking for the existence of popular scripting tools (perl, python, wget) on the system via the help commands