External Website Defacement via Web Shell Upload

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•6

This rule detects attempts to upload web shells for website defacement. It specifically looks for HTTP POST requests where the URI contains the string "deface" (case-insensitive). This combination suggests an attacker is trying to modify a website's content, potentially by uploading a malicious script or file.