Created
17th August 2023
Updated
18th August 2023
This is the query string used by tools provided from AnonymousFox, a group that develops and sells tools for hijacking webservers.
The tool suite includes webshells, persistence tools for various CMS software [Wordpress, Drupal, Joomla] and scanners.
The presence of this query string in your logs shows that bots are scanning your domain or IP for the shell.
A much thorough writeup of the actor has been made by Sucuri.