Linux Webserver Process Spawning Potential Reverse Shell

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects when a webserver process spawns suspicious child processes that might indicate a reverse shell attempt. Threat actors often exploit vulnerabilities in web applications or misconfigurations in web servers to execute malicious commands that create reverse shells. This technique is commonly used for remote access and command execution on compromised systems.

2025-05-08 00:00:00

2026-10-21 00:00:00

f3b2c4a0-5d1e-4c7b-8f6d-9e5a2f3b8c1e

attack.initial-access attack.t1190 attack.execution attack.t1059.004 attack.persistence attack.t1505.003

Nextron Sigma feed only (private)