Indirect Command Execution via Bash on Windows
This rule detects attempts to execute commands indirectly via 'bash.exe' on Windows systems, specifically looking for HTTP requests where the URI contains both 'bash.exe' and the '-c' argument, which is commonly used to pass commands to a shell. This behavior is indicative of an attacker using Bash on Windows (e.g., Windows Subsystem for Linux or Git Bash) to execute arbitrary commands, potentially as part of a defense evasion or command and control tactic.
Suricata
