Detect Web Shell Installation

Ankit Mehta@Secvyn

•updated Jun 30, 2026•2•0•2

This rule detects the creation of web shell files (ASPX, PHP, JSP) in common web server directories such as 'wwwroot', 'inetpub', or 'var\\www'. This activity is indicative of an adversary establishing persistent access to a web server.