Rule Info
Name
Shells Spawned by Web Servers in Process Tree
Description
Web servers that spawn shell processes could be the result of a successfully placed web shell or an other attack
Reference
None
Modified
2022-11-04 00:00:00
Date
2022-03-22 00:00:00
Author
Thomas Patzke, Florian Roth
Tags
attack.persistence attack.t1190 attack.t1505.003
Id
6dc0f4e1-7a11-429f-b240-d9f852cea8b3
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR