SUSP_WEBSHELL_Cmd_Indicator_Apr25

rule SUSP_WEBSHELL_Cmd_Indicator_Apr25 {
   meta:
      description = "Detects a pattern which is often related to web shell activity"
      reference = "https://regex101.com/r/N6oZ2h/2"
      author = "Florian Roth"
      date = "2025-04-25"
      modified = "2025-05-07"
      score = 60
      id = "eeeebfbc-9418-5ff4-b45f-8d96a9e7e4a8"
   strings:
      $xr01 = /\.(asp|aspx|jsp|php)\?cmd=[a-z0-9%+\-\/\.]{3,20} HTTP\/1\.[01]["']? 200/
   condition:
      1 of them
}