Recently, I was passed some error logs to take a look into, since we'd had some network spikes recently. However, I've never worked with modsecurity (I'm a programmer just doing this since we don't have a real sysadmin), and something alarming came up.
ModSecurity:
Access denied with code 503 (phase 2). Pattern match
--cut--
[line "23"] [id "390144"] [rev "2"] [msg "Command shell attack:
Generic Attempt to remote include command shell"] [severity
"CRITICAL"]
The words critical, command shell, and attack are probably not something good. I think "remote include command shell" meant a hacker was trying to pull up a shell without authorization, but that's more of a guess than anything.
Can someone tell me what's going on here, or link to some documentation I should read? Would the frequency of entries mean anything?