Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
53 rules
Windows Static Webshell Indicators via Suspicious File Extension Creation in Web Roots
Alerts on Windows creation of script-like files with webshell extensions in web root directories, excluding common benign temp and XAMPP paths.
Beyu Denis, oscd.community, Tim Shelton, Thurein Oo, Huntrule TeamWindowsfile_eventMedium142Free2019-10-22Linux auditd: Webshell Remote Command Execution via execve/execveat (euid=33)
Alerts on execve/execveat executions by the web server user, consistent with potential webshell command execution.
Ilyas Ochkov, Beyu Denis, oscd.community, Huntrule TeamLinuxauditdCritical212Free2019-10-12Windows: Process execution from web server root folders (wwwroot, htdocs, wmpub)
Alerts on Windows processes executing from typical web server root folders, consistent with webshell or backdoor staging.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium40Free2019-01-16Antivirus Web Shell Signature Matches Across ASP, JSP, PHP, Perl, and VBS
Alerts on AV signatures indicating web shells/backdoors (ASP/JSP/PHP/Perl/VBS/Webshell) to support fast investigation of persistence.
Florian Roth (Nextron Systems), Arnim Rupp, Huntrule Team—antivirusHigh248Free2018-09-09Web server access to WebLogic keystore JavaScript webshell URLs
Flags web requests attempting to access JavaScript content within a WebLogic keystore path.
Florian Roth (Nextron Systems), Huntrule Team—webserverCritical271Free2018-07-22Linux ClamAV alerts for Trojan, Webshell, Rootkit, Htran, VirTool detections
Detects ClamAV log entries with keyword-based indicators for Trojans, webshells, rootkits, and Htran.
Florian Roth (Nextron Systems), Huntrule TeamLinuxclamavHigh142Free2017-03-01Windows Webshell Command Strings in Webserver GET Requests
Identifies GET requests with URL-encoded Windows command strings consistent with webshell behavior.
Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWebwebserverHigh151Free2017-02-19Windows Webshell Recon Command-Line Keywords via Web Server Processes
Flags Windows process chains where web server parents spawn reconnaissance- and execution-related command lines indicative of webshell activity.
Florian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson, Huntrule TeamWindowsprocess_creationHigh307Free2017-01-01