REDCap help.php Web Shell Creation
Detects the creation or modification of a web shell named 'help.php' within REDCap application directories, a known persistence mechanism used by UNC6508. This rule specifically looks for file creation, modification, or renaming events for 'help.php' in paths containing 'redcap'.
Microsoft Sentinel (KQL)
