Active Network Connections Listed via Web Shell

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•3

This rule detects attempts to list active network connections using the 'netstat' command via a web shell. It specifically looks for HTTP requests where the URI contains the case-insensitive string 'netstat'. This activity is indicative of an attacker trying to gain reconnaissance on the compromised system's network connections.