System Language and Locale Queried via Web Shell

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•2

This rule detects attempts to query system language and locale information via a web shell. It specifically looks for HTTP requests where the URI contains the case-insensitive string "systeminfo". This activity is indicative of an attacker using a web shell to gather reconnaissance about the compromised system's configuration.