ATT&CK T1505.003 - Web Shell Access Detected (cmd param)

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects potential web shell access by looking for HTTP requests to PHP files that contain a 'cmd=' parameter in the URI. This pattern is commonly used by web shells to execute commands on a compromised web server, aligning with MITRE ATT&CK technique T1505.003 for web shell persistence.