Sandworm Webshell Deployment

Tim Peck@timpeck

•updated Oct 31, 2025•6•0•164

Detects the use of command-line download tools to write a file with a web-related extension to a common web server directory. This behavior is consistent with webshell deployment, as seen in Sandworm campaigns.