Webshell Detection Suspicious Children

Florian Roth, Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Swachchhanda Shrawan Poudel (Nextron Systems)

Detects suspicious child processes spawned by web server processes based on image names and command line contents. Typically, webshells do not generate unusual Windows processes. If such processes are detected, it may indicate that a vulnerability in the software hosted on the web server has been exploited for remote code execution (RCE).

2022-03-22 00:00:00

2025-02-24 00:00:00

9a8e8057-32a7-432d-bf80-197dacf1a77f

attack.persistence attack.t1505.003 attack.t1018 attack.t1033 attack.t1087

Nextron Sigma feed only (private)