Hamdani Imad
@Ihamdani0 followers2 downloads22 copies1 like42 views
1 detection
Filters
Last updated
All Time
Detection languages
1
Categories
1
MITRE Techniques
1
1
1
1
1
Detects web requests associated with PHP2Shell exploitation attempts: probing for randomized shell_<8 hex> files in common upload directories (.php, .phtml, .php5, .phar) and PoC marker strings in the query string. In the observed campaign these probes returned 404,but a 200 response on a matching path should be treated as a confirmed webshell.
