Windows Webshell Command Strings in Webserver GET Requests
Identifies GET requests with URL-encoded Windows command strings consistent with webshell behavior.
- Category
- webserver
- Author
- Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2017-02-19
- Updated
- 2026-07-31
ATT&CK techniques
PersistenceRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags webserver HTTP GET requests whose query strings contain URL-encoded command fragments commonly seen in Windows webshells. Attackers use these command strings to execute reconnaissance and system administration actions via an injected or hosted webshell. Detection relies on webserver request logs capturing the HTTP method (GET) and the full request content needed to match the specified keyword patterns in the URL.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Webshell Command Strings in Webserver GET Requests
id: f624636c-6f37-4c54-a539-4400ff8395c1
status: test
description: This rule flags webserver HTTP GET requests whose query strings contain URL-encoded command fragments commonly seen in Windows webshells. Attackers use these command strings to execute reconnaissance and system administration actions via an injected or hosted webshell. Detection relies on webserver request logs capturing the HTTP method (GET) and the full request content needed to match the specified keyword patterns in the URL.
references:
- https://bad-jubies.github.io/RCE-NOW-WHAT/
- https://m365internals.com/2022/10/07/hunting-in-on-premises-exchange-server-logs/
- https://github.com/SigmaHQ/sigma/blob/master/rules/web/webserver_generic/web_win_webshells_in_access_logs.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2017-02-19
modified: 2022-11-18
tags:
- attack.persistence
- attack.t1505.003
logsource:
category: webserver
detection:
selection_method:
cs-method: GET
selection_keywords:
- =whoami
- =net%20user
- =net+user
- =net%2Buser
- =cmd%20/c%
- =cmd+/c+
- =cmd%2B/c%
- =cmd%20/r%
- =cmd+/r+
- =cmd%2B/r%
- =cmd%20/k%
- =cmd+/k+
- =cmd%2B/k%
- =powershell%
- =powershell+
- =tasklist%
- =tasklist+
- =wmic%
- =wmic+
- =ssh%
- =ssh+
- =python%
- =python+
- =python3%
- =python3+
- =ipconfig
- =wget%
- =wget+
- =curl%
- =curl+
- =certutil
- =copy%20%5C%5C
- =dsquery%
- =dsquery+
- =nltest%
- =nltest+
condition: all of selection_*
falsepositives:
- Web sites like wikis with articles on os commands and pages that include the os commands in the URLs
- User searches in search boxes of the respective website
level: high
license: DRL-1.1
related:
- id: 7ff9db12-1b94-4a79-ba68-a2402c5d6729
type: derived