System Reboot Command via Web Shell Execution
This rule detects attempts to execute a system reboot command via a web shell. It specifically looks for the case-insensitive string "reboot" within the HTTP URI of established client-to-server HTTP traffic. This activity is indicative of an attacker who has gained control over a web server and is using a web shell to issue system-level commands, potentially to disrupt services or cover tracks.
Suricata
