Web Shell File Creation Detected in Web Directories

Ankit Mehta@Secvyn

•updated Jun 25, 2026•1•0•7

This rule monitors file system events for the creation of files with common web shell names (e.g., shell.php, cmd.php) within known web server directory paths (e.g., wwwroot, inetpub). The detection of these specific file names in directories typically used for serving web content is a strong indicator of a potential web shell deployment.