CL-STA-1062 ASPX Web Shell Creation in IIS Web Root Directories

Ibrahim Saud@tektrix

•updated Jun 27, 2026•1•0•10

Detects the creation of .aspx files within common IIS web root directories (inetpub, wwwroot). The rule identifies potential web shell activity by monitoring for specific suspicious filenames (e.g., cmd, shell, upload, file) or by flagging any ASPX creation performed by processes not typically associated with legitimate web application deployments.