Detect Suspicious Windows Path Strings in Web URI Query (Windows Exfil/Webshell Clues)

Alerts when a web URI query contains encoded or plain Windows path strings indicative of possible exfiltration or webshell behavior.

FreeUnreviewedSigmahighv1

detect-suspicious-windows-path-strings-in-web-uri-query-windows-exfil-webshell-c-9f6a34b4

title: Detect Suspicious Windows Path Strings in Web URI Query (Windows Exfil/Webshell Clues)
id: 4ac34f7d-9a6d-4d78-ac20-2378de6aaf3c
status: test
description: This rule flags web requests where the URI query contains Windows path or drive-string patterns such as C:\Windows, C:\Users, or encoded equivalents. Attackers may embed these paths in URLs to support webshell-like activity or attempt to stage data access and exfiltration via HTTP parameters. It relies on webserver telemetry that records the full request URI, specifically the query string.
references:
  - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/webserver_generic/web_susp_windows_path_uri.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-06
modified: 2023-01-02
tags:
  - attack.persistence
  - attack.exfiltration
  - attack.t1505.003
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query|contains:
      - =C:/Users
      - =C:/Program%20Files
      - =C:/Windows
      - =C%3A%5CUsers
      - =C%3A%5CProgram%20Files
      - =C%3A%5CWindows
  condition: selection
falsepositives:
  - Legitimate application and websites that use windows paths in their URL
level: high
license: DRL-1.1
related:
  - id: 9f6a34b4-2688-4eb7-a7f5-e39fef573d0e
    type: derived

What it detects

This rule flags web requests where the URI query contains Windows path or drive-string patterns such as C:\Windows, C:\Users, or encoded equivalents. Attackers may embed these paths in URLs to support webshell-like activity or attempt to stage data access and exfiltration via HTTP parameters. It relies on webserver telemetry that records the full request URI, specifically the query string.

Known false positives

Legitimate application and websites that use windows paths in their URL

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.