BLUEBEAM (Godzilla) Web Shell Payload Detection

Ethan Andrews@eandrews

•updated May 26, 2026•3•0•125

Identifies the SHA-256 hash associated with the BLUEBEAM (Godzilla) web shell payload (LoadLibrary.dll) dropped during KnowledgeDeliver exploitation. This rule looks for the specific hash across file creation, image load, or process execution events.