Rule Info
Name
Shells Spawned by Web Servers in Process Tree
Author
Thomas Patzke, Florian Roth, Swachchhanda Shrawan Poudel (Nextron Systems)
Description
Web servers that spawn shell processes could be the result of a successfully placed web shell or an other attack
Date
2022-03-22 00:00:00
Modified
2025-02-24 00:00:00
Id
6dc0f4e1-7a11-429f-b240-d9f852cea8b3
Tags
attack.persistence attack.t1505.003 attack.t1190
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR