ColdFusion Webshell Deployment - Known Filenames or Web Process Spawning Shell

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

This rule detects potential web shell activity on ColdFusion or IIS servers by monitoring for the creation of known malicious file names typically associated with web shells and the execution of suspicious child processes (e.g., cmd.exe, whoami.exe, powershell.exe) by common web server worker processes (w3wp.exe, coldfusion.exe, jrun.exe). It also identifies suspicious command-line patterns referencing the web root directory.