Better web shell detections with Signal Sciences WAF
ID: eba55cd1-1308-5b0d-b612-36436c26d189
STIX ID: report--eba55cd1-1308-5b0d-b612-36436c26d189
Feed Name: Expel Blog
Threat Score
This blog post explains what web shells are, outlines common detection techniques, and provides a detailed workflow for creating Signal Sciences WAF rules to detect web shell activity. It demonstrates a WSO web shell example (including specific POST parameters used by the shell), describes configuring site signals and verbose logging for investigation, and offers downloadable rules for detecting multiple web shell families.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.