From 4a5b3a0d438a0f7d18a7b07cb47f3f9f9e89b847 Mon Sep 17 00:00:00 2001
From: Mikhail Kasimov <mikhail.kasimov@gmail.com>
Date: Tue, 30 Mar 2021 11:27:33 +0300
Subject: [PATCH] Update web_shells.txt

---
 trails/static/suspicious/web_shells.txt | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/trails/static/suspicious/web_shells.txt b/trails/static/suspicious/web_shells.txt
index 8f2c8a55fd25..33708a8d39a4 100644
--- a/trails/static/suspicious/web_shells.txt
+++ b/trails/static/suspicious/web_shells.txt
@@ -845,3 +845,9 @@ podathon.org/shell/
 # Reference: https://twitter.com/xuy1202/status/1374694429911523333
 
 /c99.txt
+
+# Reference: https://krebsonsecurity.com/2021/03/no-i-did-not-hack-your-ms-exchange-server/
+# Reference: https://otx.alienvault.com/pulse/6061ebaf97943b790e97e899
+# Reference: https://www.virustotal.com/gui/file/5f7d898ade3162bfb0c8d3006c42e934ff81fab3b4ad3b51c13441fd63e438cb/detection
+
+/owa/auth/babydraco.aspx