Sigma detection rules, expert-reviewed

Malicious IIS Worker Process Spawning Command Shell for Webshell Reconnaissance (via process_creation)

This rule detects the IIS worker process w3wp.exe spawning cmd.exe, the webshell execution behavior Red Canary observed during a hospital ransomware intrusion where the shell ran net.exe reconnaissance before lateral movement and Cobalt Strike deployment. A web server worker launching an interactive command shell is a strong sign of a deployed webshell running operating-system commands, making early detection critical for catching post-exploitation before ransomware.

Suspicious PHP Webshell Access with Hardcoded Key

This rule detects POST requests containing the hardcoded key iUqPd tied to the PHP webshell deployed after PAN-OS exploitation. This behavior matches Operation Lunar Peek where operators executed system commands through a webshell parameter guarded by a static key. Webshell interaction on a firewall or web-facing host indicates active post-exploitation command execution.

Malicious ManagementMailboxPicker Webshell Written by Diplomatic Specter

This rule detects the creation of the ManagementMailboxPicker.aspx webshell used by the Operation Diplomatic Specter campaign to maintain access to compromised Exchange and web servers. The webshell provides persistent remote command execution and staging for mailbox theft. Detecting its file creation exposes server-side persistence and hands-on access by the espionage actor.

Malicious MOVEit human2 Webshell File Creation via file_event

This rule detects creation of the human2.aspx web shell dropped into the MOVEit Transfer wwwroot after exploitation of the CVE-2023-34362 SQL injection chain. This artifact gives the attacker web-accessible command and data-theft capability on the MOVEit host and its presence is a reliable sign of active exploitation.

Suspicious JSP Webshell Compiled Class Creation in Web Application Work Directory

This rule detects creation of a compiled JSP class named welcome_jsp associated with the webshell dropped during F5 and Citrix exploitation observed by NCC Group. Web application servers compile deployed JSP files into class artifacts and an unexpected welcome webshell class indicates server side code execution persistence.

Malicious WIREFIRE Webshell Access on Ivanti Connect Secure API Path (via webserver)

This rule detects HTTP requests to the Ivanti Connect Secure /api/v1/cav/client/visits endpoint that WIREFIRE trojanizes into a webshell. Suspected APT actors modified this component to accept encrypted commands and payloads through crafted requests to that URI. Traffic to this specific tampered API path signals interaction with the WIREFIRE backdoor.

Suspicious Command Shell Spawned by MSSQL Server Process Indicating Webshell

This rule detects the SQL Server process sqlservr.exe spawning a command shell or scripting interpreter, a pattern seen when the PassiveNeuron actors deployed an ASPX webshell and executed commands through MSSQL. A database engine spawning cmd or PowerShell is highly abnormal and typically means the server has been compromised for remote command execution and initial foothold.

Suspicious PHP Webshell in Netscaler VPN Theme Directory

This rule detects requests to PHP files under the Netscaler /vpn/themes/ path, where the actor planted webshells following Netscaler exploitation. The theme image directories serve static assets and should not host PHP, so PHP execution there indicates a webshell used for post-exploitation access.

Malicious Web Server Spawning Command Shell and curl Download via Webshell

This rule detects an Apache httpd web server process spawning a command shell or curl download, matching AntSword webshell activity in the Nezha China-nexus intrusion set. The webserver context is abused to execute commands and pull additional tooling onto the host. Legitimate web servers do not launch interactive shells or file downloaders, making this a strong webshell indicator.

Possible Ivanti EPMM In-Memory Java Webshell Access via mifs 403.jsp

This rule detects inbound requests to the /mifs/403.jsp path on Ivanti Endpoint Manager Mobile, the location of an in-memory Java webshell planted during active exploitation. Access to this path indicates post-exploitation command-and-control against EPMM appliances traced to a single bulletproof-hosted IP.

Suspicious ToolShell Webshell Written to SharePoint Layouts Directory

This rule detects creation of the ToolShell webshell files spinstall0.aspx or ghostfile-prefixed .aspx files used by multiple threat actors after exploiting the SharePoint ToolShell vulnerability chain. These named ASPX payloads dropped onto a SharePoint server provide persistent remote command execution and are strong indicators of compromise.

Suspicious Webshell Deployment in DNN DesktopModules Directory

This rule detects creation of ASP.NET handler (.ashx) files inside the DotNetNuke DesktopModules directory, a webshell staging location used by the FamousSparrow group for initial access and persistence on IIS servers. Web-facing handler files written into CMS module folders commonly represent server-side backdoors enabling remote command execution.

Suspicious TOLLBOOTH Webshell URI Access

This rule detects HTTP requests to the /mywebdll endpoint exposed by the TOLLBOOTH IIS webshell. The operator authenticates to this path to issue commands through the malicious native module, making requests to this fixed URI a reliable compromise indicator.

Possible SAP NetWeaver CVE-2025-31324 Webshell Upload via metadatauploader Endpoint (via webserver)

This rule detects POST requests to the SAP NetWeaver metadatauploader endpoint abused in CVE-2025-31324 for unauthenticated webshell upload. China-nexus actors dropped JSP webshells through this development server path. Requests to this endpoint from untrusted sources warrant investigation.

Possible Ivanti Connect Secure Webshell Access

This rule detects HTTP access to Ivanti Connect Secure API paths and CGI scripts associated with the WIREFIRE, LIGHTWIRE, and backdoored compcheckresult webshells dropped during the zero-day exploitation. Attackers use these implanted webshells for persistent remote command execution on the appliance. Requests to these specific endpoints indicate an already-compromised device.