Webshell ReGeorg Detection Via Web Logs

SigmaHQ Detections@sigmaHQ

•updated Nov 24, 2025•0•0•1

Certain strings in the uri_query field when combined with null referer and null user agent can indicate activity associated with the webshell ReGeorg.