Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Unusual File Creation via Web Server

This rule leverages the "new_terms" rule type to detect unusual file creations originating from web server processes on Linux systems. Attackers may exploit web servers to maintain persistence on a compromised system, often resulting in atypical file creations. As file creations from web server processes are common, the "new_terms" rule type approach helps to identify deviations from normal behavior.

ATT&CK coverage

Initial Access

T1190Exploit Public-Facing Application 216 detections cover this technique

Execution

T1059Command and Scripting Interpreter450 detections cover this technique
- T1059.004Unix Shell 187 detections cover this technique

Persistence

T1505Server Software Component35 detections cover this technique
- T1505.003Web Shell 66 detections cover this technique

Command and Control

T1071Application Layer Protocol 112 detections cover this technique

Detection requirements

Log source category: event_index

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.