Request for Webshell in .well-known directory
This rule detects HTTP requests to the '.well-known/' directory that include common webshell file extensions (php, cfm, cgi, asp, aspx, jsp, rb, sh, py, pl). This activity is suspicious as the '.well-known/' directory is typically used for standardized metadata files (e.g., for ACME challenges, security.txt) and not for executable scripts. The rule specifically excludes requests from 'Let's Encrypt validation server' to reduce false positives.
Suricata
