AhsayCBS - Webshell Dropped in Web Directory
Detects creation of a JSP/JSPX/WAR server-side script inside an AhsayCBS installation or web application directory. In this campaign the actors exploited critical AhsayCBS vulnerabilities and dropped webshells into the application web directories to maintain persistent remote access. Legitimate deployment writes scripts from the AhsayCBS updater, not ad-hoc into web roots.
YARA-L
