All Detections

Native API Abuse via Web Shell Execution

avatar
Darshan Thummar@Mighty
updated Jun 11, 2026002

This rule detects attempts to abuse native Windows API functions, specifically 'NtCreateProcess', via web shell execution. It looks for HTTP requests where the URI content includes 'NtCreateProcess' in a case-insensitive manner, indicating a potential web shell trying to create a new process on the server.

Suricata