## Detecting Command Injection

When input meant for a form is passed to a System Shell.

### Signatures
*   `; cat /etc/passwd` (The semicolon chains commands).
*   `| whoami`
*   `$(reboot)`
*   `&& ping 1.1.1.1`

### Review
If you see these characters `; | $ &` in a Username or Search field in your logs, you are being attacked.