YARA rules tagged WEBSHELL
4 rules carry the tag “WEBSHELL”.
Detects Chopper WebShell Injection Variant (not only Hafnium related)
APT / threat actorSignature Base (Florian Roth / Nextron)· Markus Neis,Swisscom· 2021-03-05Detects WebShell Injection
APT / threat actorSignature Base (Florian Roth / Nextron)· Markus Neis,Swisscom· 2021-03-05A simple ASPX Webshell that allows an attacker to write further files to disk.
WebshellSignature Base (Florian Roth / Nextron)· threatintel@volexity.com· 2021-03-01Detects the .NET version of the suo5 webshell
WebshellSynacktiv rules· Synacktiv, Maxence Fossat [@cybiosity]· 2025-05-12