Shells Spawned by Web Servers in Process Tree

Rule Info

Name
Shells Spawned by Web Servers in Process Tree
Author
Thomas Patzke, Florian Roth
Description
Web servers that spawn shell processes could be the result of a successfully placed web shell or an other attack
Reference
None
Date
2022-03-22 00:00:00
Modified
2022-11-04 00:00:00
Id
6dc0f4e1-7a11-429f-b240-d9f852cea8b3
Tags
attack.persistence attack.t1505.003 attack.t1190
Type
Nextron Sigma feed only (private)

Rule History