Suspicious File Write to Webapps Root Directory

SigmaHQ Detections@sigmaHQ

•updated Oct 20, 2025•1•0•22

Detects suspicious file writes to the root directory of web applications, specifically targeting Apache or Tomcat servers. This activity often indicates an attempt to deploy malicious files like web shells or other unauthorized scripts, potentially after exploiting a public-facing application.