System Time Queried via Web Shell Command
This rule detects attempts to query the system time using the 'net time' command via a web shell. It specifically looks for the string 'net time' within the HTTP URI of traffic flowing to the server. This activity is indicative of an attacker using a web shell to gather information about the compromised system, specifically its time synchronization status or current time.
Suricata
