Suspicious File Write to Webapps Root Directory (via file_event)

title: Suspicious File Write to Webapps Root Directory (via file_event)
id: 0232eaf9-0fee-5d55-9d1f-18f31cd0d0ef
status: stable
description: This rule detects anomalous file writes to the root directory of web applications, particularly Apache web servers or Tomcat servers. This may indicate an attempt to deploy hostile files such as web shells or other unauthorized scripts.
references:
    - https://attack.mitre.org/techniques/T1190/
    - https://attack.mitre.org/techniques/T1505/003/
    - https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/
author: Huntrule Team
date: 2026-01-18
tags:
    - attack.persistence
    - attack.t1505.003
    - attack.initial-access
    - attack.t1190
logsource:
    product: windows
    category: file_event
detection:
    selection_susp_img:
        Image|endswith:
            - '\dotnet.exe'
            - '\w3wp.exe'
            - '\java.exe'
    selection_servers:
        TargetFilename|contains:
            - '\apache'
            - '\tomcat'
    selection_path:
        TargetFilename|contains: '\webapps\ROOT\'
    selection_susp_extensions:
        TargetFilename|endswith: '.jsp'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium