defensive-file-upload

What problem does it solve?

File upload abuse is a common attack vector against web applications. This skill helps identify malicious uploads and webshell activity by combining YARA signatures, logging analysis, and IOC mapping to enable rapid containment.

Core Features & Use Cases

• YARA-based webshell detection in upload directories and webroots.
• Sigma rules for HTTP requests to upload paths and file-creation events.
• KQL queries for MDE DeviceFileEvents and Web server logs to surface webshell activity.
• Use Case: SOC teams triage upload abuse incidents and DFIR accelerates investigations.

Quick Start

Inspect upload directories with a YARA scan, correlate with logs to confirm suspicious webshell activity, and begin containment.