Windows Static Webshell Indicators via Suspicious File Extension Creation in Web Roots
Alerts on Windows creation of script-like files with webshell extensions in web root directories, excluding common benign temp and XAMPP paths.
- Product
- windows
- Category
- file_event
- Author
- Beyu Denis, oscd.community, Tim Shelton, Thurein Oo (SigmaHQ), DRL 1.1
- Published
- 2019-10-22
- Updated
- 2026-07-31
ATT&CK techniques
PersistenceRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies file creation events on Windows where the target filename is under common static web root paths and uses web-executable scripting extensions. Such uploads or dropped files can indicate an attacker attempting to establish persistent webshell access. It relies on Windows file event telemetry with access to TargetFilename, plus image/process context to exclude known benign patterns.
Reporting behind it
- PT ESC rule and personal experiencePT ESC rule and personal experience
- github.comhttps://github.com/swisskyrepo/PayloadsAllTheThings/blob/c95a0a1a2855dc0cd7f7327614545fe30482a636/Upload%20Insecure%20Files/README.md
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_webshell_creation_detect.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Static Webshell Indicators via Suspicious File Extension Creation in Web Roots
id: 5d8954c2-617c-4972-969e-2beef3778d60
status: test
description: This rule identifies file creation events on Windows where the target filename is under common static web root paths and uses web-executable scripting extensions. Such uploads or dropped files can indicate an attacker attempting to establish persistent webshell access. It relies on Windows file event telemetry with access to TargetFilename, plus image/process context to exclude known benign patterns.
references:
- PT ESC rule and personal experience
- https://github.com/swisskyrepo/PayloadsAllTheThings/blob/c95a0a1a2855dc0cd7f7327614545fe30482a636/Upload%20Insecure%20Files/README.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_webshell_creation_detect.yml
author: Beyu Denis, oscd.community, Tim Shelton, Thurein Oo, Huntrule Team
date: 2019-10-22
modified: 2023-10-15
tags:
- attack.persistence
- attack.t1505.003
logsource:
product: windows
category: file_event
detection:
selection_wwwroot_path:
TargetFilename|contains: \inetpub\wwwroot\
selection_wwwroot_ext:
TargetFilename|contains:
- .ashx
- .asp
- .ph
- .soap
selection_htdocs_path:
TargetFilename|contains:
- \www\
- \htdocs\
- \html\
selection_htdocs_ext:
TargetFilename|contains: .ph
filter_main_temp:
TargetFilename|contains:
- \AppData\Local\Temp\
- \Windows\Temp\
filter_main_system:
Image: System
filter_main_legitimate:
TargetFilename|contains: \xampp
condition: (all of selection_wwwroot_* or all of selection_htdocs_*) and not 1 of filter_main_*
falsepositives:
- Legitimate administrator or developer creating legitimate executable files in a web application folder
level: medium
license: DRL-1.1
related:
- id: 39f1f9f2-9636-45de-98f6-a4046aa8e4b9
type: derived