Windows Webshell Command Execution via HTTP GET
This rule detects attempts to execute common Windows operating system commands via HTTP GET requests, which is a common characteristic of web shell activity. The rule specifically looks for URL-encoded versions of commands like 'whoami', 'net user', 'cmd /c', 'powershell', 'tasklist', 'wmic', 'ssh', 'python', 'ipconfig', 'wget', 'curl', 'certutil', 'copy \\', 'dsquery', and 'nltest'. These commands are often used by attackers to gain information about the compromised system, escalate privileges, or establish further persistence after deploying a web shell.
Sigma
