ColdFusion Webshell Re-deployment in Web-Accessible Directories

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects the creation of known webshell filenames within web-accessible directories (such as wwwroot or CFIDE) by ColdFusion or IIS worker processes. This behavior is indicative of an adversary re-establishing persistence or re-compromising a web server through unauthorized file drops after initial exploitation.