Webserver URI Detects DEWMODE Webshell Access Attempts
Identifies webserver requests with DEWMODE webshell-specific URI query parameter patterns.
- Category
- webserver
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2021-02-22
- Updated
- 2026-07-31
ATT&CK techniques
PersistenceRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags web requests whose URL query parameters match DEWMODE webshell access patterns, specifically combinations of dwn and fn parameters with a .html? suffix. Such behavior matters because it can indicate exploitation for persistent server-side control. Detection relies on webserver request telemetry, matching the full query string patterns in the requested URI.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Webserver URI Detects DEWMODE Webshell Access Attempts
id: f96c6698-200a-49ef-a6a4-d6649145f14b
status: test
description: This rule flags web requests whose URL query parameters match DEWMODE webshell access patterns, specifically combinations of dwn and fn parameters with a .html? suffix. Such behavior matters because it can indicate exploitation for persistent server-side control. Detection relies on webserver request telemetry, matching the full query string patterns in the requested URI.
references:
- https://www.mandiant.com/resources/blog/accellion-fta-exploited-for-data-theft-and-extortion
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/TA/UNC2546/web_unc2546_dewmode_php_webshell.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-02-22
modified: 2023-01-02
tags:
- attack.persistence
- attack.t1505.003
- detection.emerging-threats
logsource:
category: webserver
detection:
selection1:
cs-uri-query|contains|all:
- ?dwn=
- "&fn="
- .html?
selection2:
cs-uri-query|contains|all:
- "&dwn="
- ?fn=
- .html?
condition: 1 of selection*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: fdf96c90-42d5-4406-8a9c-14a2c9a016b5
type: derived