Registry Query via Web Shell for System Recon

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•2

This rule detects attempts to query the Windows Registry via a web shell for system reconnaissance purposes. It specifically looks for HTTP requests containing the string "reg query" in the URI, indicating a command execution attempt to gather system information.