AT Command Execution via Web Shell

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects attempts to execute AT commands via a web shell. It specifically looks for HTTP requests containing both 'at+' and 'cmd' in the URI, case-insensitively. This pattern is indicative of an attacker trying to run system commands through a compromised web application.