Web Shell Deployment: Script Drop Followed by Web Server Shell Spawn

Ibrahim Saud@tektrix

•updated 8 days ago•0•0•2

Detects the creation of web scripts (aspx, php, jsp) in typical web server directories followed by suspicious shell activity (cmd, powershell, or shell execution) originating from web server processes within a 10-minute window. This behavior is indicative of a web shell being dropped and subsequently utilized for command execution.