Caddy Double Extension Bypass Upload Attempt
Detects HTTP upload attempts to web directories where a request URL contains a suspicious double file extension pattern (e.g., a web shell extension followed by an image or document extension). This technique is commonly used to bypass web server or application-level security filters that check for forbidden file types by looking at the final extension while the server might execute the underlying script.
Sigma
