Timestomping of ASPX Webshells in ColdFusion wwwroot to Corrupt MAC Times

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the modification or creation of .aspx files within the ColdFusion 'wwwroot\Images' directory. The rule flags both known webshell filenames and generic .aspx files that are not modified by the IIS worker process (w3wp.exe), which is indicative of unauthorized file manipulation or webshell deployment.