Unauthenticated WebSocket upgrade to terminal/shell endpoint indicative of web-terminal exploitation

Duo Tech@duotech

•updated Jul 30, 2026•0•0•9

Detects unauthenticated WebSocket upgrade requests to a terminal/shell-related URI path or subprotocol, lacking Authorization or Cookie headers, indicative of unauthenticated web-terminal exploitation.