huntrule

Webserver URI Detects DEWMODE Webshell Access Attempts

Identifies webserver requests with DEWMODE webshell-specific URI query parameter patterns.

FreeReviewedSigma · High · v5
Category
webserver
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2021-02-22
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Persistence

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags web requests whose URL query parameters match DEWMODE webshell access patterns, specifically combinations of dwn and fn parameters with a .html? suffix. Such behavior matters because it can indicate exploitation for persistent server-side control. Detection relies on webserver request telemetry, matching the full query string patterns in the requested URI.

Reporting behind it

Related detections9 linkedT1505.003 — drag to rearrange
Suspicious Weaver Ant In-Memory Web Shell Marker in Web Request (via webserver)
Malicious Web Server Process Spawning Command Interpreter via Web Shell (via process_creation)
Malicious Web Shell Written to SharePoint LAYOUTS Directory by Worker Process (via file_event)
Malicious IIS Worker Process Spawning Command Shell for Webshell Reconnaissance (via process_creation)
Malicious Command Shell Spawned by SQL Server via Process Creation (via process_creation)
Suspicious PHP Webshell Access with Hardcoded Key
Suspicious IIS Configuration Reconnaissance via Appcmd (via process_creation)
Malicious ManagementMailboxPicker Webshell Written by Diplomatic Specter
Malicious MOVEit human2 Webshell File Creation via file_event
Webserver URI Detects DEWMODE Webshell Access Attempts
Pivot detection · T1505.003 · 9 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.