huntrule

Windows Webshell Command Strings in Webserver GET Requests

Identifies GET requests with URL-encoded Windows command strings consistent with webshell behavior.

FreeReviewedSigma · High · v2
Category
webserver
Author
Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2017-02-19
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Persistence

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags webserver HTTP GET requests whose query strings contain URL-encoded command fragments commonly seen in Windows webshells. Attackers use these command strings to execute reconnaissance and system administration actions via an injected or hosted webshell. Detection relies on webserver request logs capturing the HTTP method (GET) and the full request content needed to match the specified keyword patterns in the URL.

Reporting behind it

Related detections9 linkedT1505.003 — drag to rearrange
Suspicious Weaver Ant In-Memory Web Shell Marker in Web Request (via webserver)
Malicious Web Server Process Spawning Command Interpreter via Web Shell (via process_creation)
Malicious Web Shell Written to SharePoint LAYOUTS Directory by Worker Process (via file_event)
Malicious IIS Worker Process Spawning Command Shell for Webshell Reconnaissance (via process_creation)
Malicious Command Shell Spawned by SQL Server via Process Creation (via process_creation)
Suspicious PHP Webshell Access with Hardcoded Key
Suspicious IIS Configuration Reconnaissance via Appcmd (via process_creation)
Malicious ManagementMailboxPicker Webshell Written by Diplomatic Specter
Malicious MOVEit human2 Webshell File Creation via file_event
Windows Webshell Command Strings in Webserver GET Requests
Pivot detection · T1505.003 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.