Shell injection attempt detected

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.


Detect Shell Injection attempts on web services executing shell commands. Such security activity generally indicates that an attacker is trying to exploit a potential shell injection vulnerability and execute malicious code on your server.


Monitor shell injection attempts (@appsec.security_activity:attack_attempt.command_injection) on routes executing shell commands (@_dd.appsec.enrichment.has_shell:true). Excludes 404 due to excessive noise found during testing. Monitor the presence of errors tieds to command execution (@_dd.appsec.enrichment.spans_with_error:system) to detect potential failed exploits.

Generate an Application Security Signal with Medium severity if attacks on routes executing commands are found.
Raise the severity to High if errors were generated on the same trace.

Triage and response

  1. Consider blocking the attacking IP(s) temporarily to prevent them to reach deeper parts of your production systems.
  2. Investigate if the parameters are ending up in shell commands executed without sanitization. If they do, fix the code.
  3. Investigate if the host was compromised.