| splunk |
Windows Suspicious Child Process Spawned From WebServer |
production |
2026-10-28 |
| elastic |
Web Shell Detection: Script Process Child of Common Web Processes |
production |
2026-10-23 |
| elastic |
Suspicious Command Execution via Web Server |
production |
2026-10-09 |
| elastic |
Suspicious Child Execution via Web Server |
production |
2026-10-09 |
| elastic |
Unusual File Creation via Web Server |
production |
2026-09-27 |
| elastic |
Initial Access via File Upload Followed by GET Request |
production |
2026-09-18 |
| elastic |
Potential SAP NetWeaver Exploitation |
production |
2026-09-18 |
| elastic |
Potential IIS Web Shell File Creation |
production |
2026-09-18 |
| elastic |
ScreenConnect Server Spawning Suspicious Processes |
production |
2026-09-18 |
| elastic |
Windows Server Update Service Spawning Suspicious Processes |
production |
2026-09-18 |
| elastic |
Microsoft Exchange Worker Spawning Suspicious Processes |
production |
2026-09-18 |
| elastic |
Microsoft Exchange Server UM Writing Suspicious Files |
production |
2026-09-18 |
| elastic |
Unusual Command Execution via Web Server |
production |
2026-09-18 |
| elastic |
Unusual Child Execution via Web Server |
production |
2026-09-18 |
| elastic |
PHP File Creation in WordPress Plugin Directory |
production |
2026-09-18 |
| elastic |
Potential Polyglot Bypass File Created by Web Server |
production |
2026-09-18 |
| elastic |
File with High Entropy Created by Web Server |
production |
2026-09-18 |
| elastic |
File with Suspicious Double Extension Created by Web Server |
production |
2026-09-18 |
| elastic |
Simple HTTP Web Server Creation |
production |
2026-09-18 |
| elastic |
Simple HTTP Web Server Connection |
production |
2026-09-18 |
| elastic |
Potential SAP NetWeaver WebShell Creation |
production |
2026-09-18 |
| elastic |
Potential Webshell Deployed via Apache Struts CVE-2023-50164 Exploitation |
production |
2026-09-18 |
| elastic |
Web Server Exploitation Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Web Server Potential Command Injection Request |
production |
2026-09-18 |
| sigma |
Linux Webshell Indicators |
test |
2026-08-19 |
| sigma |
WordPress Wp2shell Webshell Plugin Access |
experimental |
2026-07-19 |
| sigma |
Webshell Detection With Command Line Keywords |
test |
2026-07-14 |
| elastic |
Deprecated - Uncommon Destination Port Connection by Web Server |
deprecated |
2026-07-02 |
| elastic |
Deprecated - Unusual Command Execution from Web Server Parent |
deprecated |
2026-07-02 |
| elastic |
Deprecated - Unusual Process Spawned from Web Server Parent |
deprecated |
2026-07-02 |
| sigma |
Antivirus - Web Shell Detection Signature |
test |
2026-06-29 |
| splunk |
Supernova Webshell |
experimental |
2026-05-13 |
| splunk |
Exploit Public Facing Application via Apache Commons Text |
production |
2026-05-13 |
| splunk |
Spring4Shell Payload URL Request |
production |
2026-05-13 |
| splunk |
Tomcat Session Deserialization Attempt |
production |
2026-05-13 |
| splunk |
Windows SharePoint ToolPane Endpoint Exploitation Attempt |
production |
2026-05-13 |
| splunk |
Windows SharePoint Spinstall0 GET Request |
production |
2026-05-13 |
| splunk |
Web JSP Request via URL |
production |
2026-05-13 |
| splunk |
Tomcat Session File Upload Attempt |
production |
2026-05-13 |
| splunk |
Detect Exchange Web Shell |
production |
2026-05-13 |
| splunk |
MS Exchange Mailbox Replication service writing Active Server Pages |
experimental |
2026-05-13 |
| splunk |
Windows Metasploit Confluence Plugin Execution |
production |
2026-05-13 |
| splunk |
Windows Potential Web Shell Creation For VMware Workspace ONE |
production |
2026-05-13 |
| splunk |
Windows SharePoint Spinstall0 Webshell File Creation |
production |
2026-05-13 |
| splunk |
Windows TeamCity Payload Execution from Temp Directory |
production |
2026-05-13 |
| splunk |
Windows TeamCity Plugin Installed |
production |
2026-05-13 |
| splunk |
Windows WSUS Spawning Shell |
production |
2026-05-13 |
| splunk |
Cisco Configuration Archive Logging Analysis |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Privileged Command Execution via HTTP |
production |
2026-05-13 |
| sigma |
Webshell Remote Command Execution |
test |
2025-12-05 |
| sigma |
Commvault QOperation Path Traversal Webshell Drop (CVE-2025-57790) |
experimental |
2025-10-20 |
| sigma |
Suspicious File Write to Webapps Root Directory |
experimental |
2025-10-20 |
| sigma |
Suspicious File Write to SharePoint Layouts Directory |
experimental |
2025-07-24 |
| sigma |
Potential Java WebShell Upload in SAP NetViewer Server |
experimental |
2025-05-14 |
| sigma |
Potential SAP NetViewer Webshell Command Execution |
experimental |
2025-05-14 |
| sigma |
Suspicious Process Spawned by CentreStack Portal AppPool |
experimental |
2025-04-17 |
| sigma |
Suspicious Process By Web Server Process |
test |
2024-11-26 |
| sigma |
IIS Native-Code Module Command Line Installation |
test |
2024-03-13 |
| sigma |
Execution From Webserver Root Folder |
test |
2024-01-18 |
| sigma |
Webshell Hacking Activity Patterns |
test |
2023-11-09 |
| sigma |
Webshell Tool Reconnaissance Activity |
test |
2023-11-09 |
| sigma |
Potential Webshell Creation On Static Website |
test |
2023-10-15 |
| sigma |
MOVEit CVE-2023-34362 Exploitation Attempt - Potential Web Shell Request |
test |
2023-07-28 |
| sigma |
Suspicious Child Process Of SQL Server |
test |
2023-05-04 |
| sigma |
Mailbox Export to Exchange Webserver |
test |
2023-04-30 |
| elastic |
Potential Shell via Web Server |
deprecated |
2023-03-04 |
| sigma |
Certificate Request Export to Exchange Webserver |
test |
2023-01-23 |
| sigma |
Exchange Set OabVirtualDirectory ExternalUrl Property |
test |
2023-01-23 |
| sigma |
Rejetto HTTP File Server RCE |
test |
2023-01-02 |
| sigma |
Oracle WebLogic Exploit |
test |
2023-01-02 |
| sigma |
Solarwinds SUPERNOVA Webshell Access |
test |
2023-01-02 |
| sigma |
DEWMODE Webshell Access |
test |
2023-01-02 |
| sigma |
CVE-2021-40539 Zoho ManageEngine ADSelfService Plus Exploit |
test |
2023-01-02 |
| sigma |
Webshell ReGeorg Detection Via Web Logs |
test |
2023-01-02 |
| sigma |
Suspicious Windows Strings In URI |
test |
2023-01-02 |
| sigma |
Windows Webshell Strings |
test |
2022-11-18 |
| sigma |
Shellshock Expression |
test |
2022-10-09 |
| sigma |
Suspicious File Drop by Exchange |
test |
2022-10-04 |
| sigma |
Chopper Webshell Process Pattern |
test |
2022-10-01 |
| sigma |
Suspicious ASPX File Drop by Exchange |
test |
2022-10-01 |
| sigma |
Suspicious MSExchangeMailboxReplication ASPX Write |
test |
2022-02-25 |