Shells Spawned by Web Servers in Process Tree

Rule Info

Tags
attack.persistence attack.t1190 attack.t1505.003
Name
Shells Spawned by Web Servers in Process Tree
Id
6dc0f4e1-7a11-429f-b240-d9f852cea8b3
Date
2022-03-22 00:00:00
Modified
2022-11-04 00:00:00
Description
Web servers that spawn shell processes could be the result of a successfully placed web shell or an other attack
Reference
None
Author
Thomas Patzke, Florian Roth
Type
Nextron Sigma feed only (private)

Rule History