Webserver: Suspicious Windows Path Strings in URI Query
Alerts when a web URI query contains encoded or plain Windows path strings indicative of possible exfiltration or webshell behavior.
- Category
- webserver
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-06-06
- Updated
- 2026-07-31
ATT&CK techniques
PersistenceRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags web requests whose URI query contains Windows path indicators such as C:\Windows, C:\Users, or Program Files encoded in common forms. Attackers may use URI parameters to carry filesystem paths during exfiltration attempts or webshell-related communication. Detection relies on webserver logs capturing the requested URI query string and performing substring matches against the specified encoded Windows path patterns.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Webserver: Suspicious Windows Path Strings in URI Query"
id: 4ac34f7d-9a6d-4d78-ac20-2378de6aaf3c
status: test
description: This rule flags web requests whose URI query contains Windows path indicators such as C:\Windows, C:\Users, or Program Files encoded in common forms. Attackers may use URI parameters to carry filesystem paths during exfiltration attempts or webshell-related communication. Detection relies on webserver logs capturing the requested URI query string and performing substring matches against the specified encoded Windows path patterns.
references:
- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
- https://github.com/SigmaHQ/sigma/blob/master/rules/web/webserver_generic/web_susp_windows_path_uri.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-06
modified: 2023-01-02
tags:
- attack.persistence
- attack.exfiltration
- attack.t1505.003
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains:
- =C:/Users
- =C:/Program%20Files
- =C:/Windows
- =C%3A%5CUsers
- =C%3A%5CProgram%20Files
- =C%3A%5CWindows
condition: selection
falsepositives:
- Legitimate application and websites that use windows paths in their URL
level: high
license: DRL-1.1
related:
- id: 9f6a34b4-2688-4eb7-a7f5-e39fef573d0e
type: derived