IvantiSentry_JSP_RuntimeExec_Webshell

rule IvantiSentry_JSP_RuntimeExec_Webshell
{
    meta:
        description = "Compact JSP command webshell (Runtime.exec of a request parameter)"
        reference = "CVE-2026-10520 Ivanti Sentry exploitation"
    strings:
        $exec = "Runtime.getRuntime().exec" ascii
        $param = "request.getParameter" ascii
        $io = "getInputStream" ascii
    condition:
        filesize < 8KB and $exec and $param and $io
}