Sigma rule: Potential Webshell Creation On Static Website

Rule

Title

Potential Webshell Creation On Static Website

Status

test

Level

medium

Author

Beyu Denis, oscd.community, Tim Shelton, Thurein Oo

Date

2019-10-22

Modified

2023-10-15

File

rules/windows/file/file_event/file_event_win_webshell_creation_detect.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the creation of files with certain extensions on a static web site. This can be indicative of potential uploads of a web shell.

Log source

product

windows

category

file_event

Detection

selection_wwwroot_path:
    TargetFilename|contains: '\inetpub\wwwroot\'
selection_wwwroot_ext:
    TargetFilename|contains:
        - '.ashx'
        - '.asp'
        - '.ph'
        - '.soap'
selection_htdocs_path:
    TargetFilename|contains:
        - '\www\'
        - '\htdocs\'
        - '\html\'
selection_htdocs_ext:
    TargetFilename|contains: '.ph'
# selection_tomcat_path:
#     TargetFilename|contains: '\webapps\ROOT'
# selection_tomcat_ext:
#     TargetFilename|contains:
#         - '.jsp' # .jspx, .jspf
#         - '.jsv'
#         - '.jsw'
filter_main_temp:  # FP when unpacking some executables in $TEMP
    TargetFilename|contains:
        - '\AppData\Local\Temp\'
        - '\Windows\Temp\'
filter_main_system:
    Image: 'System' # FP when backup/restore from drivers
filter_main_legitimate:
    TargetFilename|contains: '\xampp'
condition: (all of selection_wwwroot_* or all of selection_htdocs_*) and not 1 of filter_main_*

False positives (as the rule lists them)

• Legitimate administrator or developer creating legitimate executable files in a web application folder

Tags

• attack.persistence
• attack.t1505.003

MITRE ATT&CK ids this rule names

• T1505.003

References

• PT ESC rule and personal experience
• https://github.com/swisskyrepo/PayloadsAllTheThings/blob/c95a0a1a2855dc0cd7f7327614545fe30482a636/Upload%20Insecure%20Files/README.md

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/file/file_event/file_event_win_webshell_creation_detect.yml