Command injection attempt detected
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、
お気軽にご連絡ください。
Goal
Detect Command Injection attempts on web services executing shell commands. Such security activity generally indicates that an attacker is trying to exploit a potential command injection vulnerability and execute malicious code on your server.
Strategy
Monitor command injection attempts (@appsec.security_activity:attack_attempt.command_injection
) on routes executing shell commands (@_dd.appsec.enrichment.has_shell:true
).
Excludes 404 due to excessive noise found during testing.
Monitor the presence of errors tied to command execution (@_dd.appsec.enrichment.spans_with_error:system
) to detect potential failed exploits.
Generate an Application Security Signal with Medium
severity if attacks on routes executing commands are found.
Raise the severity to High
if errors were generated on the same trace.
Triage and response
- Consider blocking the attacking IP(s) temporarily to prevent them to reach deeper parts of your production systems.
- Investigate if the parameters are ending up in shell commands executed without sanitization. If they do, fix the code.
- Investigate if the host was compromised.