Private Key File Harvested via Web Shell

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects attempts to harvest private key files (with extensions like .key, .pem, .p12, .pfx, .pkcs12) via HTTP requests, often indicative of a web shell being used to exfiltrate sensitive cryptographic material from a compromised server. The detection is based on the URI of the HTTP request.