Rule Info
Name
WEBSHELL_CSS_PassThrough_Sep26
Author
Florian Roth
Description
Detects suspicious CSS files that contain pass-through and cookie decoding functionality, which is often used in webshells
Score
70
Date
2026-09-28
Minimum Yara
3.5.0
Rule Hash
fe4c8e4bf2e4fbeed8771ac2e44a5a94
Tags
['WEBSHELL', 'T1505_003']
Required Modules
[]
Antivirus Verdicts
Rating
Number of Samples
Malicious (>= 10 engines)
14
Suspicious (< 10 engines)
3
Clean (0 engines)
0
Rule Matches
Timestamp
Positives
Total
Hash
VT
Rule Matches per Month (last 24 months)
Scan your endpoints, forensic images or collected files with our portable scanner THOR