ATT&CK T1059.003 - CMD Shell via Web Request

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects HTTP web requests that contain the string "cmd.exe" in the URI, indicating an attempt to execute a command shell via a web request. This is often associated with web application attacks where an attacker tries to leverage a vulnerability to run system commands.