Antivirus Web Shell Detection
This rule detects highly relevant antivirus alerts that specifically report the presence of a web shell. It is designed to flag antivirus detections where the signature indicates a web shell, often identified by keywords related to common web scripting languages (ASP, PHP, JSP, Perl) and terms like 'Backdoor', 'Webshell', or specific web shell names (C99shell, Chopper). The rule emphasizes that such alerts, even if the malware is blocked, warrant further investigation into how the web shell was initially placed on the system.
Sigma
