Web Shell Written to ScreenConnect App_Extensions Directory

PremiumReviewedSigma · High · v1
Product
windows
Category
file_event
Author
HuntRule
Published
2026-06-28
Updated
2026-08-28

ATT&CK techniques

Initial Access → Persistence
  1. Recon

  2. Resource Dev

  3. Execution

  4. Priv Esc

  5. Defense Evasion

  6. Cred Access

  7. Discovery

  8. Lateral Movement

  9. Collection

  10. C2

  11. Exfiltration

  12. Impact

What it detects

This rule detects aspx or ashx files written to the ScreenConnect App_Extensions directory, where post-exploitation of the authentication bypass drops server-side web shells for code execution. Huntress observed operators writing extension pages to this root after gaining admin access. Executable web content in this location is not part of normal product operation and signals web shell installation.

Related detections9 linkedT1190 — drag to rearrange
Possible Citrix ShareFile Unauthenticated Upload Path Traversal Webshell (CVE-2023-24489) (via webserver)
Possible Unauthenticated Admin Creation in Dynamicweb CVE-2022-25369
Possible DotCMS Path Traversal Webshell Upload via content API CVE-2022-26352
Possible Avaya Aura Device Services WebDAV PHP Webshell Upload via PhoneBackup (via webserver)
Possible DotCMS Arbitrary File Upload and JSP Webshell Drop via api content (via webserver)
Malicious Dynamicweb Unauthenticated Administrator Creation via Setup Default.aspx (via webserver)
Possible PHP Webshell Access After Malicious ZIP Upload (via webserver)
Possible Oracle Opera CGI Webshell Command Execution via operabin
Possible Pre-Auth Webshell Upload via Oracle Opera FileReceiver Servlet
Web Shell Written to ScreenConnect App_Extensions Directory
Pivot detection · T1190 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.