Tag
Unusual Child Execution via Web Server
2 rules 4 TTPsThis rule detects unusual child process executions originating from web server processes on Linux systems, potentially indicating attackers exploiting web servers for persistence.
Unusual Command Execution from Web Server Parent Process on Linux
2 rules 3 TTPsThis rule detects potential command execution from a web server parent process on a Linux host, indicating a possible web shell attack where adversaries exploit web server vulnerabilities to execute arbitrary commands.
DreamMaker Arbitrary File Upload Vulnerability (CVE-2026-10072)
2 rules 2 TTPs 1 CVEDreamMaker by Interinfo is vulnerable to arbitrary file upload, allowing privileged remote attackers to upload and execute web shell backdoors, enabling arbitrary code execution on the server.
KnowledgeDeliver ViewState Deserialization Vulnerability Exploitation
2 rules 4 TTPs 1 CVEAn unauthenticated remote code execution vulnerability, CVE-2026-5426, in Digital Knowledge's KnowledgeDeliver LMS platform due to shared ASP.NET machine keys allows attackers to inject malicious code, ultimately leading to Cobalt Strike infection of user workstations.
CVE-2021-47937: e107 CMS Authenticated Remote Code Execution via Theme Upload
2 rules 2 TTPs 1 CVEe107 CMS 2.3.0 contains a remote code execution vulnerability (CVE-2021-47937) that allows authenticated users with theme installation permissions to execute arbitrary commands by uploading malicious theme files, leading to arbitrary code execution on the server.
Sunnet CTMS/CPAS Arbitrary File Upload Vulnerability (CVE-2026-7490)
2 rules 3 TTPs 1 CVEA privileged remote attacker can exploit CVE-2026-7490 in Sunnet CTMS and CPAS to upload and execute web shell backdoors, leading to arbitrary code execution on the server.
Borg SPM 2007 Arbitrary File Upload Vulnerability (CVE-2026-6885)
2 rules 1 TTP 1 CVEAn unauthenticated remote attacker can exploit an arbitrary file upload vulnerability (CVE-2026-6885) in Borg SPM 2007 to upload and execute web shell backdoors, leading to arbitrary code execution on the server.
FlowiseAI File Upload Validation Bypass Leads to RCE
2 rules 2 TTPs 1 CVEA file upload validation bypass vulnerability exists in FlowiseAI, where the Chatflow configuration file upload settings can be modified to allow the application/javascript MIME type, enabling an attacker to upload .js files, store malicious Node.js web shells on the server, and potentially achieve Remote Code Execution (RCE).
Potential Web Shell ASPX File Creation
2 rules 1 TTPThe creation of ASPX files in web server directories, excluding legitimate processes, indicates potential web shell deployment for persistence on Windows systems.
Uncommon Destination Port Connection by Web Server on Linux
2 rules 4 TTPsThe rule identifies unusual outbound network connections on non-standard ports originating from web server processes on Linux systems, indicative of potential web shell activity or unauthorized communication.
Windows Shell Execution from IIS Installation Directory
2 rules 2 TTPsDetection of command-line tools executing from the IIS installation directory on Windows systems, potentially indicating exploitation of IIS-reliant software like Microsoft Exchange.