ATT&CK T1059.004 - Unix Shell via Web Request

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•3

This rule detects HTTP web requests where the URI contains the string "/bin/sh" (case-insensitive). This pattern is often indicative of an attempt to execute a Unix shell command via a web application, which could be part of a command injection attack (ATT&CK T1059.004).