Webshell Re-Infection via Known ColdFusion Webshell Filenames (POST/200)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects potential re-compromise attempts by monitoring for access, file creation, or process execution associated with a set of known malicious web shell files. It correlates IIS web server logs (HTTP POST requests to shell files), EDR file modification events, and EDR process spawning events from common web server binaries (w3wp.exe, coldfusion.exe, jrun.exe) to identify persistence remaining after remediation.