SHADOW-EARTH-053 Web Shell Drop
Identifies the creation of specific web shell filenames associated with SHADOW-EARTH-053 within targeted IIS and Exchange Web application directories. This rule detects the creation of known web shell files in critical web server paths, indicating an adversary's attempt to establish persistent access and remote control over the compromised server.
Microsoft Sentinel (KQL)
