Rule Info
Name
Web Server Executing Suspicious Commands
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Description
Detects web servers spawning processes with suspicious command patterns often associated with reverse shells or command injection.
Threat actors may exploit vulnerabilities in web applications or misconfigurations in web servers to execute malicious commands that create reverse shells.
Date
2025-05-08 00:00:00
Modified
2026-10-21 00:00:00
Id
1f4be477-ff36-4f6b-937d-d16dd03d8e41
Tags
attack.execution attack.t1059.004 attack.initial-access attack.t1190 attack.persistence attack.t1505.003
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR