ATT&CK T1059.004 - Unix Shell /bin/bash via Web

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects attempts to execute the Unix shell '/bin/bash' via HTTP requests. Specifically, it looks for the string '/bin/bash' within the URI of HTTP traffic flowing to the server. This could indicate an attacker attempting command injection or other web-based exploitation to gain shell access.