Shells Spawned by Web Servers in Process Tree

Rule Info

Name
Shells Spawned by Web Servers in Process Tree
Author
Thomas Patzke, Florian Roth
Description
Web servers that spawn shell processes could be the result of a successfully placed web shell or an other attack
Reference
None
Date
2022-03-22 00:00:00
Modified
2022-11-04 00:00:00
Id
6dc0f4e1-7a11-429f-b240-d9f852cea8b3
Tags
attack.persistence attack.t1505.003 attack.t1190
Type
Nextron Sigma feed only (private)

Rule History

THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022