Detect Web Shell Activity (Command Execution from Web Directory)
This rule detects the execution of common command-line utilities (wget, curl, nc, bash, python, perl, php, sh) within web server directories. This activity is highly suspicious as it could indicate an attacker attempting to download malicious files, execute web shells, or perform other post-exploitation activities on a compromised web server.
Splunk (SPL)
