Webworm Stages Tools inside a Forked Repository Tree
Detects the staging of operational executables (like FRP, proxy tools, secrets dumpers, or scanners) within web application administration directories or repository checkouts. This activity is suspicious as these directories should primarily contain source code or web application files, not executable tools. The detection specifically looks for these executables being created or modified by processes commonly associated with code repositories or command-line operations (git, powershell, curl, cmd).
Cortex XDR
