Shells Spawned by Web Servers in Process Tree

Rule Info

Name
Shells Spawned by Web Servers in Process Tree
Description
Web servers that spawn shell processes could be the result of a successfully placed web shell or an other attack
Reference
None
Modified
2022-11-04 00:00:00
Date
2022-03-22 00:00:00
Author
Thomas Patzke, Florian Roth
Tags
attack.persistence attack.t1190 attack.t1505.003
Id
6dc0f4e1-7a11-429f-b240-d9f852cea8b3
Type
Nextron Sigma feed only (private)

Rule History