Command Injection In Web Request POST Body
Detects potential command injection attempts in the body of HTTP POST requests. Attackers, such as those operating the RondoDoX botnet, exploit unsanitized input fields in web interfaces of SOHO routers, IoT devices, and other applications to execute arbitrary commands. This rule looks for common command-line tools and shell characters within the POST body, particularly in requests targeting parameters known to be vulnerable.
Sigma
