| elastic |
Web Shell Detection: Script Process Child of Common Web Processes |
production |
2026-10-23 |
| elastic |
Suspicious Command Execution via Web Server |
production |
2026-10-09 |
| elastic |
Suspicious Child Execution via Web Server |
production |
2026-10-09 |
| elastic |
Execution via MSSQL xp_cmdshell Stored Procedure |
production |
2026-10-05 |
| elastic |
Unusual File Creation via Web Server |
production |
2026-09-27 |
| elastic |
AWS Bedrock Agent or Action Group Manipulation |
production |
2026-09-25 |
| elastic |
AWS Bedrock Third-Party or External Knowledge Base Associated to Agent |
production |
2026-09-25 |
| elastic |
AWS Bedrock Agent Created by IAM User or Root |
production |
2026-09-25 |
| elastic |
Simple HTTP Web Server Connection |
production |
2026-09-18 |
| elastic |
File with Suspicious Double Extension Created by Web Server |
production |
2026-09-18 |
| elastic |
File with High Entropy Created by Web Server |
production |
2026-09-18 |
| elastic |
Potential Polyglot Bypass File Created by Web Server |
production |
2026-09-18 |
| elastic |
PHP File Creation in WordPress Plugin Directory |
production |
2026-09-18 |
| elastic |
Unusual Child Execution via Web Server |
production |
2026-09-18 |
| elastic |
Unusual Command Execution via Web Server |
production |
2026-09-18 |
| elastic |
MySQL User-Defined Function Injection |
production |
2026-09-18 |
| elastic |
Unsigned DLL loaded by DNS Service |
production |
2026-09-18 |
| elastic |
Potential IIS Web Shell File Creation |
production |
2026-09-18 |
| elastic |
ScreenConnect Server Spawning Suspicious Processes |
production |
2026-09-18 |
| elastic |
Windows Server Update Service Spawning Suspicious Processes |
production |
2026-09-18 |
| elastic |
Microsoft Exchange Worker Spawning Suspicious Processes |
production |
2026-09-18 |
| elastic |
Microsoft Exchange Server UM Writing Suspicious Files |
production |
2026-09-18 |
| elastic |
Potential SAP NetWeaver WebShell Creation |
production |
2026-09-18 |
| elastic |
Potential SAP NetWeaver Exploitation |
production |
2026-09-18 |
| elastic |
Initial Access via File Upload Followed by GET Request |
production |
2026-09-18 |
| elastic |
Web Server Potential Command Injection Request |
production |
2026-09-18 |
| elastic |
Web Server Potential SQL Injection Request |
production |
2026-09-18 |
| elastic |
Web Server Exploitation Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Potential Webshell Deployed via Apache Struts CVE-2023-50164 Exploitation |
production |
2026-09-18 |
| elastic |
Simple HTTP Web Server Creation |
production |
2026-09-18 |
| splunk |
Linux Suspicious Redis Activity |
production |
2026-07-08 |
| elastic |
Deprecated - Unusual Process Spawned from Web Server Parent |
deprecated |
2026-07-02 |
| elastic |
Deprecated - Uncommon Destination Port Connection by Web Server |
deprecated |
2026-07-02 |
| elastic |
Deprecated - Unusual Command Execution from Web Server Parent |
deprecated |
2026-07-02 |
| splunk |
Windows Shell Process from CrushFTP |
production |
2026-05-13 |
| splunk |
Confluence Unauthenticated Remote Code Execution CVE-2022-26134 |
production |
2026-05-13 |
| suricata |
ET MALWARE PHASEJAM Web Shell Activity Observed M1 |
rev 2 |
2026-05-07 |
| snort |
ET TROJAN PHASEJAM Web Shell Activity Observed M1 |
rev 2 |
2026-05-07 |
| suricata |
ET MALWARE PHASEJAM Web Shell Activity Observed M2 |
rev 2 |
2026-05-07 |
| snort |
ET TROJAN PHASEJAM Web Shell Activity Observed M2 |
rev 2 |
2026-05-07 |
| sigma |
Cisco Modify Configuration |
test |
2025-04-28 |
| suricata |
ET MALWARE Webshell Landing Outbound - Possibly Iran-based |
rev 2 |
2024-03-08 |
| suricata |
ET WEB_SERVER Suspected HrServ Webshell Related Activity M2 |
rev 1 |
2024-01-12 |
| snort |
ET WEB_SERVER Suspected HrServ Webshell Related Activity M1 |
rev 1 |
2024-01-12 |
| snort |
ET WEB_SERVER Suspected HrServ Webshell Related Activity M2 |
rev 1 |
2024-01-12 |
| suricata |
ET WEB_SERVER Suspected HrServ Webshell Related Activity M1 |
rev 1 |
2024-01-12 |
| snort |
ET WEB_SERVER vonloesch JSP File Browser |
rev 1 |
2023-11-30 |
| suricata |
ET WEB_SERVER vonloesch JSP File Browser |
rev 1 |
2023-11-30 |
| snort |
ET WEB_SERVER Simple JSP WebShell Landing Page |
rev 1 |
2023-11-30 |
| suricata |
ET WEB_SERVER Simple JSP WebShell Landing Page |
rev 1 |
2023-11-30 |
| snort |
ET ATTACK_RESPONSE Possible /etc/shadow via HTTP M3 |
rev 1 |
2023-11-29 |
| suricata |
ET ATTACK_RESPONSE Possible /etc/shadow via HTTP M1 |
rev 1 |
2023-11-29 |
| suricata |
ET ATTACK_RESPONSE Possible /etc/shadow via HTTP M2 |
rev 1 |
2023-11-29 |
| suricata |
ET ATTACK_RESPONSE Possible /etc/shadow via HTTP M3 |
rev 1 |
2023-11-29 |
| suricata |
ET ATTACK_RESPONSE Possible /etc/shadow via HTTP M4 |
rev 1 |
2023-11-29 |
| snort |
ET ATTACK_RESPONSE Possible /etc/shadow via HTTP M1 |
rev 1 |
2023-11-29 |
| snort |
ET ATTACK_RESPONSE Possible /etc/shadow via HTTP M2 |
rev 1 |
2023-11-29 |
| snort |
ET ATTACK_RESPONSE Possible /etc/shadow via HTTP M4 |
rev 1 |
2023-11-29 |
| snort |
ET WEB_SERVER Tunna Variant Webshell Activity |
rev 2 |
2023-11-03 |
| suricata |
ET WEB_SERVER Tunna Variant Webshell Activity |
rev 2 |
2023-11-03 |
| elastic |
Potential Shell via Web Server |
deprecated |
2023-03-04 |
| snort |
ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server |
rev 1 |
2021-11-12 |
| suricata |
ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server |
rev 1 |
2021-11-12 |
| suricata |
ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server |
rev 1 |
2021-11-12 |
| snort |
ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server |
rev 1 |
2021-11-12 |
| snort |
ET CURRENT_EVENTS Webshell Execute Command Inbound - Possibly Iran-based M1 |
rev 1 |
2021-07-25 |
| suricata |
ET MALWARE Webshell Access with Known Password Inbound - Possibly Iran-based |
rev 1 |
2021-07-25 |
| suricata |
ET MALWARE Webshell Upload Command Inbound - Possibly Iran-based |
rev 1 |
2021-07-25 |
| suricata |
ET MALWARE Webshell Execute Command Inbound - Possibly Iran-based M1 |
rev 1 |
2021-07-25 |
| snort |
ET CURRENT_EVENTS Webshell Access with Known Password Inbound - Possibly Iran-based |
rev 1 |
2021-07-25 |
| snort |
ET CURRENT_EVENTS Webshell Upload Command Inbound - Possibly Iran-based |
rev 1 |
2021-07-25 |
| snort |
ET CURRENT_EVENTS Webshell Landing Outbound - Possibly Iran-based |
rev 1 |
2021-07-25 |