Webshell Deployment
Detects deployment of web shells, backdoor scripts, and malicious web application files
14 rules in webshell_deployment.yml
CRITICAL: 11 | HIGH: 3
| Rule ID | Severity | Title | Description | Refs |
|---|---|---|---|---|
antsword_ | CRITICAL | AntSword Webshell Deployment | Deploys content associated with AntSword, a webshell management platform | |
aspx_ | CRITICAL | ASPX Webshell Deployment | Deploys an ASPX file with Process.Start or cmd.exe invocation patterns | |
behinder_ | CRITICAL | Behinder Webshell Deployment | Deploys content associated with Behinder (冰蝎), an encrypted webshell supporting PHP/JSP/.NET | |
china_ | CRITICAL | China Chopper Webshell Pattern | Detects the classic China Chopper one-liner pattern that evaluates HTTP request parameters | |
godzilla_ | CRITICAL | Godzilla Webshell Deployment | Deploys content associated with Godzilla, a Java/.NET encrypted webshell framework | |
jsp_ | CRITICAL | JSP Webshell Deployment | Deploys a JSP file with Runtime.exec or ProcessBuilder patterns used in webshells | |
named_ | CRITICAL | Known PHP Webshell Deployment (b374k/c99/r57) | Deploys known named PHP webshells (b374k, c99, r57) to web-accessible paths | |
nodejs_ | CRITICAL | Node.js Web Backdoor Deployment | Writes Node.js files combining HTTP server functionality with child_process command execution to web directories | |
php_ | CRITICAL | PHP Webshell Deployment | Deploys a PHP file containing shell execution functions commonly used in webshells | |
python_ | CRITICAL | Python Webshell / Backdoor Server | Starts a Python HTTP server with command execution capabilities | |
weevely_ | CRITICAL | Weevely Webshell Generator | Invokes weevely, a PHP backdoor generator that creates encrypted webshells with shell-like sessions | |
cgi_ | HIGH | CGI Script Deployment to Web Directory | Task deploys a .pl/.py/.sh/.rb/.cgi script under /var/www/cgi-bin (or nginx/lampp/srv equivalents). Executable scripts in CGI directories are the classic webshell deployment shape. | |
perl_ | HIGH | Perl CGI Webshell Deployment | Deploys Perl CGI scripts with system execution capabilities to web directories | |
web_ | HIGH | Suspicious File Write to Web Root | Writes executable or script files directly to web server document roots |