DEWMODE Webshell Access Detection

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•25

Detects access patterns indicative of the DEWMODE webshell, which was used in attacks exploiting Accellion FTA. The rule looks for specific query parameters ('?dwn=', '&fn=', '.html?' or '&dwn=', '?fn=', '.html?') within the URI query string, which are characteristic of how this webshell operates.