Potential Webshell Creation On Static Website
This rule detects the creation of files with specific web-related extensions (.ashx, .asp, .ph, .soap) in common web server directories such as '\inetpub\wwwroot\', '\www\', '\htdocs\', or '\html\'. This activity is often indicative of an attacker uploading a web shell to maintain persistence or execute commands on the compromised web server.
Sigma
