OS command injection separator with binary in HTTP parameter

Ali AlEnezi@site

•updated Sep 15, 2026•0•0•1

This rule detects potential OS command injection attempts in HTTP request parameters by monitoring for common shell command separators and subsequent execution of suspicious system binaries (e.g., sh, bash, curl, wget, python).