Web Shell Uploaded to Server Application Directory

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects attempts to upload web shell files to a server's application directory. It specifically looks for HTTP POST requests where the URI contains common web shell file extensions (php, asp, aspx, jsp, cfm) and the file data contains the string "eval(" (case-insensitive), which is a common function used in web shells for code execution.