Antivirus - Web Shell Detection Signature
Detects a highly relevant Antivirus alert that reports a web shell. (...)
Generic test antivirus - - - Florian Roth (Nextron Systems), Arnim Rupp 2018-09-09 2026-06-29 fdf135a2-9241-4f96-a114-bb404948f736
10 Certificate Request Export to Exchange Webserver
Detects a write of an Exchange CSR to an untypical directory or with aspx name suffix which can be u (...)
Generic test - windows Exchange - Max Altgelt (Nextron Systems) 2021-08-23 2023-01-23 b7bc7038-638b-4ffd-880c-292c692209ef
1 Chopper Webshell Process Pattern
Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells
Generic test process_creation windows Sysmon · WinEventLog Security Florian Roth (Nextron Systems), MSTI (query) 2022-10-01 — fa3c117a-bc0d-416e-a31b-0c0e80653efb
1 Splunk
Cisco Configuration Archive Logging Analysis
This analytic provides comprehensive monitoring of configuration changes on Cisco devices by analyzing archive logs. (...)
Hunting stable configuration_change - Cisco IOS · Cisco Bhavin Patel, Michael Haag, Splunk 2025-08-21 2026-05-13 f52d5c0b-d45d-4304-b300-a4f6a1130dec
3 Splunk
Cisco Secure Firewall - Privileged Command Execution via HTTP
This analytic detects HTTP requests to privileged execution paths on Cisco routers, specifically targeting the `/level/15/exec/-/*` endpoint using Cisco Secure Firewall Intrusion Events. (...)
Anomaly stable firewall - Cisco Secure Firewall · Cisco - Nasreddine Bencherchali, Michael Haag, Splunk 2026-01-12 2026-05-13 0c1d2e3f-4a5b-6c7d-8e9f-0a1b2c3d4e5f
1 Commvault QOperation Path Traversal Webshell Drop (CVE-2025-57790)
Detects the use of qoperation.exe with the -file argument to write a JSP file to the webroot, indicating a webshell drop. (...)
Emerging experimental process_creation windows Sysmon · WinEventLog Security Swachchhanda Shrawan Poudel (Nextron Systems) 2025-10-20 — bd3b3fff-a018-4994-9876-68af5809160f
1 CVE-2021-40539 Zoho ManageEngine ADSelfService Plus Exploit
Detects an authentication bypass vulnerability affecting the REST API URLs in ADSelfService Plus (CVE-2021-40539).
Emerging test webserver - - Sittikorn S, Nuttakorn Tungpoonsup 2021-09-10 2023-01-02 fcbb4a77-f368-4945-b046-4499a1da69d1
3 Splunk
Detect Exchange Web Shell
The following analytic identifies the creation of suspicious .aspx files in known drop locations for Exchange exploitation, specifically targeting paths associated with HAFNIUM group and vulnerabilities like ProxyShell and ProxyNotShell. (...)
Generic stable file_event windows Sysmon - Michael Haag, Shannon Davis, David Dorsey, Splunk 2021-03-18 2026-05-13 8c14eeee-2af1-4a4b-bda8-228da0f4862a
4 DEWMODE Webshell Access
Detects access to DEWMODE webshell as described in FIREEYE report
Emerging test webserver - - - Florian Roth (Nextron Systems) 2021-02-22 2023-01-02 fdf96c90-42d5-4406-8a9c-14a2c9a016b5
1 Exchange Set OabVirtualDirectory ExternalUrl Property
Rule to detect an adversary setting OabVirtualDirectory External URL property to a script in Exchang (...)
Generic test - windows Exchange - Jose Rodriguez @Cyb3rPandaH 2021-03-15 2023-01-23 9db37458-4df2-46a5-95ab-307e7f29e675
1 Execution From Webserver Root Folder
Detects a program executing from a web server root folder. (...)
Hunting test process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems) 2019-01-16 2024-01-18 35efb964-e6a5-47ad-bbcd-19661854018d
1 Splunk
Exploit Public Facing Application via Apache Commons Text
The following analytic detects attempts to exploit the CVE-2022-42889 vulnerability in the Apache Commons Text Library, known as Text4Shell. (...)
Anomaly stable webserver - Nginx Michael Haag, Splunk 2022-10-26 2026-05-13 19a481e0-c97c-4d14-b1db-75a708eb592e
6 IIS Native-Code Module Command Line Installation
Detects suspicious IIS native-code module installations via command line
Generic test process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems) 2019-12-11 2024-03-13 9465ddf4-f9e4-4ebd-8d98-702df3a93239
2 Linux Webshell Indicators
Detects suspicious sub processes of web server processes
Generic test process_creation linux Sysmon - Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) 2021-10-15 2026-08-19 818f7b24-0fba-4c49-a073-8b755573b9c7
2 Mailbox Export to Exchange Webserver
Detects a successful export of an Exchange mailbox to untypical directory or with aspx name suffix w (...)
Generic test - windows Exchange - Florian Roth (Nextron Systems), Rich Warren, Christian Burkard (Nextron Systems) 2021-08-09 2023-04-30 516376b4-05cd-4122-bae0-ad7641c38d48
1 MOVEit CVE-2023-34362 Exploitation Attempt - Potential Web Shell Request
Detects get requests to specific files used during the exploitation of MOVEit CVE-2023-34362
Emerging test webserver - - Nasreddine Bencherchali (Nextron Systems) 2023-06-03 2023-07-28 435e41f2-48eb-4c95-8a2b-ed24b50ec30b
2 Splunk
MS Exchange Mailbox Replication service writing Active Server Pages
The following analytic identifies the creation of suspicious .aspx files in specific directories associated with Exchange exploitation by the HAFNIUM group and the ProxyShell vulnerability. (...)
Generic experimental process_creation windows Sysmon - Michael Haag, Splunk 2021-03-18 2026-05-13 985f322c-57a5-11ec-b9ac-acde48001122
1 Oracle WebLogic Exploit
Detects access to a webshell dropped into a keystore folder on the WebLogic server
Emerging test webserver - - Florian Roth (Nextron Systems) 2018-07-22 2023-01-02 37e8369b-43bb-4bf8-83b6-6dd43bda2000
2 Potential Java WebShell Upload in SAP NetViewer Server
Detects potential Java webshell uploads via HTTP requests with Content-Type 'application/octet-stream' and Java file extensions. (...)
Emerging experimental webserver - - Swachchhanda Shrawan Poudel (Nextron Systems) 2025-05-14 — 639b893f-f93a-4e53-a7c8-f08cf73fe7f7
1 Potential SAP NetViewer Webshell Command Execution
Detects potential command execution via webshell in SAP NetViewer through JSP files with cmd parameter. (...)
Emerging experimental webserver - - Swachchhanda Shrawan Poudel (Nextron Systems) 2025-05-14 — 94e12f41-6cb3-45c5-97b1-c783a7bf2e72
1 Potential Webshell Creation On Static Website
Detects the creation of files with certain extensions on a static web site. (...)
Generic test file_event windows Sysmon - Beyu Denis, oscd.community, Tim Shelton, Thurein Oo 2019-10-22 2023-10-15 39f1f9f2-9636-45de-98f6-a4046aa8e4b9
2 Rejetto HTTP File Server RCE
Detects attempts to exploit a Rejetto HTTP File Server (HFS) via CVE-2014-6287
Emerging test webserver - - Nasreddine Bencherchali (Nextron Systems) 2022-07-19 2023-01-02 a133193c-2daa-4a29-8022-018695fcf0ae
3 Shellshock Expression
Detects shellshock expressions in log files
Generic test - linux - - Florian Roth (Nextron Systems) 2017-03-14 2022-10-09 c67e0c98-4d39-46ee-8f6b-437ebf6b950e
1 Solarwinds SUPERNOVA Webshell Access
Detects access to SUPERNOVA webshell as described in Guidepoint report
Emerging test webserver - - - Florian Roth (Nextron Systems) 2020-12-17 2023-01-02 a2cee20b-eacc-459f-861d-c02e5d12f1db
2 Splunk
Spring4Shell Payload URL Request
The following analytic detects attempts to exploit the Spring4Shell vulnerability (CVE-2022-22963) by identifying specific URL patterns associated with web shell payloads. (...)
Generic stable webserver - Nginx Michael Haag, Splunk 2022-04-05 2026-05-13 9d44d649-7d67-4559-95c1-8022ff49420b
3 Splunk
Supernova Webshell
The following analytic detects the presence of the Supernova webshell, used in the SUNBURST attack, by identifying specific patterns in web URLs. (...)
Generic experimental webserver - - - John Stoner, Splunk 2021-01-06 2026-05-13 2ec08a09-9ff1-4dac-b59f-1efd57972ec1
2 Suspicious ASPX File Drop by Exchange
Detects suspicious file type dropped by an Exchange component in IIS into a suspicious folder
Generic test file_event windows Sysmon Florian Roth (Nextron Systems), MSTI (query, idea) 2022-10-01 — bd1212e5-78da-431e-95fa-c58e3237a8e6
3 Suspicious Child Process Of SQL Server
Detects suspicious child processes of the SQLServer process. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - FPT.EagleEye Team, wagga 2020-12-11 2023-05-04 869b9ca7-9ea2-4a5a-8325-e80e62f75445
1 Suspicious File Drop by Exchange
Detects suspicious file type dropped by an Exchange component in IIS
Generic test file_event windows Sysmon Florian Roth (Nextron Systems) 2022-10-04 — 6b269392-9eba-40b5-acb6-55c882b20ba6
3 Suspicious File Write to SharePoint Layouts Directory
Detects suspicious file writes to SharePoint layouts directory which could indicate webshell activity or post-exploitation. (...)
Generic experimental file_event windows Sysmon Swachchhanda Shrawan Poudel (Nextron Systems) 2025-07-24 — 1f0489be-b496-4ddf-b3a9-5900f2044e9c
2 Suspicious File Write to Webapps Root Directory
Detects suspicious file writes to the root directory of web applications, particularly Apache web servers or Tomcat servers. (...)
Generic experimental file_event windows Sysmon - Swachchhanda Shrawan Poudel (Nextron Systems) 2025-10-20 — 89c42960-f244-4dad-9151-ae9b1a3287a2
1 Suspicious MSExchangeMailboxReplication ASPX Write
Detects suspicious activity in which the MSExchangeMailboxReplication process writes .asp and .apsx (...)
Generic test file_event windows Sysmon - Florian Roth (Nextron Systems) 2022-02-25 — 7280c9f3-a5af-45d0-916a-bc01cb4151c9
1 Suspicious Process By Web Server Process
Detects potentially suspicious processes being spawned by a web server process which could be the re (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Thomas Patzke, Florian Roth (Nextron Systems), Zach Stanford @svch0st, Tim Shelton, Nasreddine Bencherchali (Nextron Systems) 2019-01-16 2024-11-26 8202070f-edeb-4d31-a010-a26c72ac5600
1 Suspicious Process Spawned by CentreStack Portal AppPool
Detects unexpected command shell execution (cmd.exe) from w3wp.exe when tied to CentreStack's portal (...)
Emerging experimental process_creation windows Sysmon · WinEventLog Security Jason Rathbun (Blackpoint Cyber) 2025-04-17 — 2d79e371-2a27-42de-87a4-b4213fc72a6a
4 Suspicious Windows Strings In URI
Detects suspicious Windows strings in URI which could indicate possible exfiltration or webshell com (...)
Generic test webserver - - - Nasreddine Bencherchali (Nextron Systems) 2022-06-06 2023-01-02 9f6a34b4-2688-4eb7-a7f5-e39fef573d0e
1 Splunk
Tomcat Session Deserialization Attempt
This detection identifies potential exploitation of CVE-2025-24813 in Apache Tomcat through the second stage of the attack. (...)
Anomaly stable webserver - Nginx Michael Haag, Splunk 2025-03-25 2026-05-13 e28b4fd4-8f5a-41cd-8222-2f1ccca53ef1
5 Splunk
Tomcat Session File Upload Attempt
This detection identifies potential exploitation of CVE-2025-24813 in Apache Tomcat through the initial stage of the attack. (...)
Anomaly stable webserver - Nginx Michael Haag, Splunk 2025-03-25 2026-05-13 a1d8f5c3-9b7e-4f2d-8c51-3bca5e672410
5 Splunk
Web JSP Request via URL
The following analytic identifies URL requests associated with CVE-2022-22965 (Spring4Shell) exploitation attempts, specifically targeting webshell access on a remote webserver. (...)
Generic stable webserver - Nginx Michael Haag, Splunk 2022-04-05 2026-05-13 2850c734-2d44-4431-8139-1a56f6f54c01
3 Webshell Detection With Command Line Keywords
Detects certain command line parameters often used during reconnaissance activity via web shells
Generic test process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson 2017-01-01 2026-07-14 bed2a484-9348-4143-8a8a-b801c979301c
3 Webshell Hacking Activity Patterns
Detects certain parent child patterns found in cases in which a web shell is used to perform certain (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems) 2022-03-17 2023-11-09 4ebc877f-4612-45cb-b3a5-8e3834db36c9
1 Webshell ReGeorg Detection Via Web Logs
Certain strings in the uri_query field when combined with null referer and null user agent can indicate activity associated with the webshell ReGeorg.
Generic test webserver - - - Cian Heasley 2020-08-04 2023-01-02 2ea44a60-cfda-11ea-87d0-0242ac130003
2 Webshell Remote Command Execution
Detects possible command execution by web application/web shell
Generic test process_creation linux Linux Auditd - Ilyas Ochkov, Beyu Denis, oscd.community 2019-10-12 2025-12-05 c0d3734d-330f-4a03-aae2-65dacc6a8222
2 Webshell Tool Reconnaissance Activity
Detects processes spawned from web servers (PHP, Tomcat, IIS, etc.) that perform reconnaissance look (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Cian Heasley, Florian Roth (Nextron Systems) 2020-07-22 2023-11-09 f64e5c19-879c-4bae-b471-6d84c8339677
1 Splunk
Windows Metasploit Confluence Plugin Execution
Detects the malicious java plugin execution used by metasploit for Atlassian Confluence exploitation. (...)
Generic stable process_creation windows Sysmon · WinEventLog Security · CrowdStrike - Raven Tait, Splunk 2021-09-02 2026-05-13 3a3d1f35-5985-4827-b2ad-965467303c59
- Splunk
Windows Potential Web Shell Creation For VMware Workspace ONE
This analytic looks for evidence of web shells being created in the VMware Workspace ONE path on Windows or Linux systems, which has been actively exploited by attackers via CVE-2022-22954.
Anomaly stable file_event windows Sysmon Raven Tait, Splunk 2026-05-05 2026-05-13 7d15f645-58cc-4cb7-a9bf-2dcf15bc4b28
1 Splunk
Windows SharePoint Spinstall0 GET Request
The following analytic detects potential post-exploitation activity related to the Microsoft SharePoint CVE-2025-53770 vulnerability. (...)
Generic stable webserver - Suricata Michael Haag, Splunk 2025-07-21 2026-05-13 ac490de2-ee39-421c-b61b-1c4005dde427
4 Splunk
Windows SharePoint Spinstall0 Webshell File Creation
This detection identifies the creation or modification of the "spinstall0.aspx" webshell file in Microsoft SharePoint directories. (...)
Generic stable file_event windows Sysmon Michael Haag, Splunk 2025-07-21 2026-05-13 7a0dda67-4cc7-4113-b3bd-b3f1489a98bf
3 Splunk
Windows SharePoint ToolPane Endpoint Exploitation Attempt
The following analytic detects potential exploitation attempts against Microsoft SharePoint Server vulnerability CVE-2025-53770, also known as "ToolShell". (...)
Generic stable webserver - Suricata Michael Haag, Splunk 2025-07-20 2026-05-13 508b2649-3a1e-4a4c-ba9d-3cc05e1a1b70
5 Splunk
Windows Suspicious Child Process Spawned From WebServer
The following analytic identifies the execution of suspicious processes typically associated with WebShell activity on web servers. (...)
Anomaly stable process_creation windows Sysmon · WinEventLog Security · CrowdStrike - Steven Dick 2023-04-12 2026-05-13 2d4470ef-7158-4b47-b68b-1f7f16382156
3 Splunk
Windows TeamCity Payload Execution from Temp Directory
Detects the bundled TeamCity java executing a payload out of the temp directory. (...)
Generic stable process_creation windows Sysmon · WinEventLog Security · CrowdStrike Raven Tait, Splunk 2026-05-05 2026-05-13 937c59be-0975-4097-ae45-f07c894f9ff4
3