Timestomping of ASPX Files in wwwroot\Images Directory
This rule detects the creation or modification of .aspx or .php files within a 'wwwroot/images' directory, specifically where the time difference between consecutive creation events for the same file path exceeds 24 hours (86400 seconds). This behavior is often associated with the placement of web shells or backdoors in web server directories, where adversaries attempt to masquerade malicious scripts as image files.
Splunk (SPL)
