Obfuscated Cmd Command Using Environment Variables
This rule detects HTTP requests where the URI contains the string "%comspec%" (case-insensitive). This pattern is often used by attackers to obfuscate command execution, specifically by referencing the command interpreter (cmd.exe) via an environment variable, as part of defense evasion tactics. The rule is specifically looking for this string within the URI of an HTTP request flowing from the internal network to an external server.
Suricata
