System Script Used as Proxy for Code Execution
This rule detects HTTP requests where the URI contains specific system script names like 'pubprn', 'syncappvpublishingserver', or 'winrm'. These scripts are known to be abused by attackers to proxy code execution, often as a defense evasion technique. The rule specifically looks for these patterns in HTTP URIs in traffic flowing to the server.
Suricata
