Internal Web Server Content Defaced via HTTP PUT

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•3

This rule detects attempts to deface web server content by using an HTTP PUT request to modify files with extensions such as .html, .htm, .php, .asp, or .aspx. It specifically looks for HTTP PUT methods targeting these file types on an internal web server.