Server Software Component detection rulesT1505

Detects a write of an Exchange CSR to an untypical directory or with aspx name suffix which can be used to place a webshell

windows

Detects an authentication bypass vulnerability affecting the REST API URLs in ADSelfService Plus (CVE-2021-40539).

webserver

Detects a successful export of an Exchange mailbox to untypical directory or with aspx name suffix which can be used to place a webshell or the needed role assignment for it

windows

Detects access to a webshell dropped into a keystore folder on the WebLogic server

webserver

Detects access to SUPERNOVA webshell as described in Guidepoint report

webserver

Detects possible command execution by web application/web shell

linux

Detects post-exploitation access to the wp2shell webshell plugin dropped after successful exploitation of CVE-2026-63030 and CVE-2026-60137. After the pre-auth SQLi-to-admin bridge is established, the attacker can upload a malicious plugin (wp2shell) to the target WordPress instance. At this phase, the attacker accesses the webshell for command execution and persistence.

webserver

Detects a highly relevant Antivirus alert that reports a web shell. It's highly recommended to tune this rule to the specific strings used by your anti virus solution by downloading a big WebShell repository from e.g. github and checking the matches. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

antivirus

Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells

windows · process_creation

Detects the use of qoperation.exe with the -file argument to write a JSP file to the webroot, indicating a webshell drop. This is a post-authentication step corresponding to CVE-2025-57790.

windows · process_creation

Detects access to DEWMODE webshell as described in FIREEYE report

webserver

Rule to detect an adversary setting OabVirtualDirectory External URL property to a script in Exchange Management log

windows

Detects a failed installation of a Exchange Transport Agent

windows

Detects changes to of the IIS server configuration in order to disable HTTP logging for successful requests.

windows

Detects suspicious sub processes of web server processes

linux · process_creation

Detects get requests to specific files used during the exploitation of MOVEit CVE-2023-34362

webserver

Detects suspicious ".hta" file creation in the startup folder by Foxit Reader. This can be an indication of CVE-2023-27363 exploitation.

windows · file_event

Detects potential Java webshell uploads via HTTP requests with Content-Type 'application/octet-stream' and Java file extensions. This behavior might indicate exploitation of vulnerabilities like CVE-2025-31324, which allows remote code execution through webshells in SAP NetViewer.

webserver

Detects potential command execution via webshell in SAP NetViewer through JSP files with cmd parameter. This rule is created to detect exploitation of vulnerabilities like CVE-2025-31324, which allows remote code execution via a webshell.

webserver

Detects attempts to exploit a Rejetto HTTP File Server (HFS) via CVE-2014-6287

webserver

Detects shellshock expressions in log files

linux

Detects suspicious file type dropped by an Exchange component in IIS into a suspicious folder

windows · file_event

Detects suspicious child processes of the SQLServer process. This could indicate potential RCE or SQL Injection.

windows · process_creation

Detects suspicious file writes to SharePoint layouts directory which could indicate webshell activity or post-exploitation. This behavior has been observed in the exploitation of SharePoint vulnerabilities such as CVE-2025-49704, CVE-2025-49706 or CVE-2025-53770.

windows · file_event

Detects a suspicious IIS module registration as described in Microsoft threat report on IIS backdoors

windows · process_creation

Detects suspicious activity in which the MSExchangeMailboxReplication process writes .asp and .apsx files to disk, which could be a sign of ProxyShell exploitation

windows · file_event

Detects potentially suspicious processes being spawned by a web server process which could be the result of a successfully placed web shell or exploitation

windows · process_creation

Detects unexpected command shell execution (cmd.exe) from w3wp.exe when tied to CentreStack's portal.config, indicating potential exploitation (e.g., CVE-2025-30406)

windows · process_creation

Detects suspicious Windows strings in URI which could indicate possible exfiltration or webshell communication

webserver

Detects certain command line parameters often used during reconnaissance activity via web shells

windows · process_creation

Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system

windows · process_creation

Certain strings in the uri_query field when combined with null referer and null user agent can indicate activity associated with the webshell ReGeorg.

webserver

Detects processes spawned from web servers (PHP, Tomcat, IIS, etc.) that perform reconnaissance looking for the existence of popular scripting tools (perl, python, wget) on the system via the help commands

windows · process_creation

Detects common commands used in Windows webshells

webserver

Modifications to a config that will serve an adversary's impacts or persistence

cisco

Detects changes to of the IIS server configuration in order to disable/remove the ETW logging/processing option.

windows

Detects a program executing from a web server root folder. Use this rule to hunt for potential interesting activity such as webshell or backdoors

windows · process_creation

Detects suspicious IIS native-code module installations via command line

windows · process_creation

Detects the Installation of a Exchange Transport Agent

windows · process_creation

Detects the Installation of a Exchange Transport Agent

windows

Detects the addition of a new module to an IIS server.

windows

Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy

windows · process_creation

Detects the creation of files with certain extensions on a static web site. This can be indicative of potential uploads of a web shell.

windows · file_event

Detects suspicious file type dropped by an Exchange component in IIS

windows · file_event

Detects suspicious file writes to the root directory of web applications, particularly Apache web servers or Tomcat servers. This may indicate an attempt to deploy malicious files such as web shells or other unauthorized scripts.

windows · file_event

Detects suspicious SQL query keywrods that are often used during recon, exfiltration or destructive activities. Such as dropping tables and selecting wildcard fields

database

Detects the removal of a previously installed IIS module.

windows