Cron Job Injection via Web Shell

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects attempts to inject cron job commands via web shell activity. It specifically looks for HTTP requests where the URI contains the case-insensitive string "crontab", indicating an attempt to modify scheduled tasks on a system through a web interface, likely a compromised web shell.