File Deletion Command via Web Shell

Darshan Thummar@Mighty

•updated Jun 10, 2026•2•0•6

This rule detects attempts to delete files on a web server using a web shell. It specifically looks for the 'unlink' command within HTTP URI requests, indicating a potential file deletion operation initiated through a compromised web application.