Password Policy Discovered via Web Shell Command

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•1

This rule detects attempts to discover password policy information by executing the 'net accounts' command via a web shell. The rule specifically looks for HTTP requests where the URI content contains 'net accounts' in a case-insensitive manner, indicating a potential web-based command execution to gather system information related to password policies.