SignalHunt
← All rules

WEB-6005

critical

Web Shell-Style Request Pattern

Detects a request to a script file (.php/.jsp) carrying a "cmd=" parameter - a common calling convention for simple web shells that execute an attacker-supplied OS command and return the output.

T1505.003

Detection logic

{
  "detection_type": "selection",
  "selection": {
    "uri|contains": [
      ".php?cmd=",
      ".jsp?cmd="
    ]
  }
}

Log source: category=web_server · Event ID(s): access_log

Required log fields

  • client_ip
  • uri
  • status

Enabling this in your environment

Where: Web server access log configuration - standard URI/query-string logging (default in combined log format).

# no special config needed beyond default access logging

A confirmed hit here warrants immediate response, not just alerting - a live web shell means active remote code execution capability on the server. Correlate with WEB-6003/WAF-5005 for the fuller picture of how it likely got there.

False positives

  • A legitimate application parameter that happens to be literally named "cmd" for something unrelated to command execution (rare, but possible - check the specific endpoint's real behavior before treating every hit as confirmed compromise)

References