Potential Webshell Upload in SharePoint or Exchange Directories

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects the creation of suspicious files in SharePoint or Exchange directories that could indicate a webshell upload. Webshells are malicious scripts that threat actors install/upload on targeted websites to gain remote access to the system. Often, they serve as an initial point of infection in cyberattacks.

Internal Research

2025-04-22 00:00:00

None

2b959d4e-5a74-4f0b-a90d-5b01fa12126e

attack.persistence attack.t1505.003

Nextron Sigma feed only (private)