Godzilla Webshell File Creation
Detects the creation of files commonly associated with Godzilla-forked webshells, such as 'error.aspx', on a web server. Threat actors deploy these webshells for persistent access after exploiting vulnerabilities in web applications like IIS.
Sigma
