Steganographic Webshell Deployed in wwwroot Images Directory (T1027.003)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•5

This rule detects the creation of executable script files (.aspx, .php) within the webroot images directory or identifies known specific filenames associated with web shells. This behavior is indicative of an adversary attempting to establish a web shell for persistent access or command execution on a web server.