Every published rule

WordPress wp2shell Plugin Webshell Access via wp-content/plugins URL Path

Alert on HTTP requests targeting the wp2shell WordPress plugin path used for webshell execution/persistence.

Windows Process: Commvault qoperation.exe JSP Webroot Path Traversal Webshell Drop

Alerts on qoperation.exe commands that use -file to write a .jsp into a webroot path, consistent with a webshell drop.

SAP NetViewer Webshell Command Execution via JSP cmd Parameter

Alerts on SAP NetViewer JSP requests likely used as webshells to execute system commands via cmd-style query parameters.

Windows File Events: SAP NetWeaver Directory Webshell File Creation (.jsp/.java/.class)

Flags Windows file creation of JSP/Java/Class under SAP NetWeaver servlet_jsp work/root paths that may indicate webshell persistence.

Linux File Events: Webshell-like JSP/Java/Class Creation in SAP NetWeaver Directories

Alerts on Linux file creation of .jsp/.java/.class under SAP NetWeaver IRJ servlet paths that may indicate webshell deployment.

Windows Process Creation: China Chopper Webshell Command Pattern via W3WP

Flags w3wp.exe-launched commands matching China Chopper webshell execution patterns in Windows process creation logs.

Webserver: Suspicious Windows Path Strings in URI Query

Alerts when a web URI query contains encoded or plain Windows path strings indicative of possible exfiltration or webshell behavior.

Linux Process Creation Webshell Tooling: Web Server Child Processes Running System Commands

Detects web server processes spawning Linux command-line tools commonly used for host discovery or persistence.

Webserver URI Detects DEWMODE Webshell Access Attempts

Identifies webserver requests with DEWMODE webshell-specific URI query parameter patterns.

Detect SolarWinds SUPERNOVA Webshell URL Access on Webservers (logoimagehandler.ashx)

Identifies webserver traffic consistent with SUPERNOVA webshell access targeting logoimagehandler.ashx with a clazz query parameter.

Webserver logs: Webshell ReGeorg indicators in POST URI query with null Referer/User-Agent

Flags HTTP POST requests with null referer/user-agent and ReGeorg-like URI query parameters in web logs.

Windows Static Webshell Indicators via Suspicious File Extension Creation in Web Roots

Alerts on Windows creation of script-like files with webshell extensions in web root directories, excluding common benign temp and XAMPP paths.

Linux auditd: Webshell Remote Command Execution via execve/execveat (euid=33)

Alerts on execve/execveat executions by the web server user, consistent with potential webshell command execution.

Windows: Process execution from web server root folders (wwwroot, htdocs, wmpub)

Alerts on Windows processes executing from typical web server root folders, consistent with webshell or backdoor staging.

Antivirus Web Shell Signature Matches Across ASP, JSP, PHP, Perl, and VBS

Alerts on AV signatures indicating web shells/backdoors (ASP/JSP/PHP/Perl/VBS/Webshell) to support fast investigation of persistence.

Web server access to WebLogic keystore JavaScript webshell URLs

Flags web requests attempting to access JavaScript content within a WebLogic keystore path.

Linux ClamAV alerts for Trojan, Webshell, Rootkit, Htran, VirTool detections

Detects ClamAV log entries with keyword-based indicators for Trojans, webshells, rootkits, and Htran.

Windows Webshell Command Strings in Webserver GET Requests

Identifies GET requests with URL-encoded Windows command strings consistent with webshell behavior.

Windows Webshell Recon Command-Line Keywords via Web Server Processes

Flags Windows process chains where web server parents spawn reconnaissance- and execution-related command lines indicative of webshell activity.