Internal Web Server Files Modified via SMB

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•4

This rule detects attempts to modify web server files, specifically 'index.html' within a 'wwwroot' directory, over the Server Message Block (SMB) protocol. The detection is based on the presence of these strings in network traffic directed to port 445 (SMB) on the internal network. This activity could indicate an attacker attempting to deface a web server or inject malicious code.