Linux Process Creation Webshell Tooling: Web Server Child Processes Running System Commands
Detects web server processes spawning Linux command-line tools commonly used for host discovery or persistence.
- Product
- linux
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2021-10-15
- Updated
- 2026-07-31
ATT&CK techniques
PersistenceRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Linux process creation events where a web server parent process launches a child process matching common reconnaissance and system/administration command paths. Webshell activity often relies on executing OS commands through spawned sub-processes to enumerate the host and persist. It relies on telemetry that records process creation, including the parent image/command line and the child process image.
Reporting behind it
- acunetix.comhttps://www.acunetix.com/blog/articles/web-shells-101-using-php-introduction-web-shells-part-2/
- media.defense.govhttps://media.defense.gov/2020/Jun/09/2002313081/-1/-1/0/CSI-DETECT-AND-PREVENT-WEB-SHELL-MALWARE-20200422.PDF
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_webshell_detection.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Linux Process Creation Webshell Tooling: Web Server Child Processes Running System Commands"
id: b9bb2f06-d2e3-4710-be09-57e323f130b6
status: test
description: This rule flags Linux process creation events where a web server parent process launches a child process matching common reconnaissance and system/administration command paths. Webshell activity often relies on executing OS commands through spawned sub-processes to enumerate the host and persist. It relies on telemetry that records process creation, including the parent image/command line and the child process image.
references:
- https://www.acunetix.com/blog/articles/web-shells-101-using-php-introduction-web-shells-part-2/
- https://media.defense.gov/2020/Jun/09/2002313081/-1/-1/0/CSI-DETECT-AND-PREVENT-WEB-SHELL-MALWARE-20200422.PDF
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_webshell_detection.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2021-10-15
modified: 2022-12-28
tags:
- attack.persistence
- attack.t1505.003
logsource:
product: linux
category: process_creation
detection:
selection_general:
ParentImage|endswith:
- /httpd
- /lighttpd
- /nginx
- /apache2
- /node
- /caddy
selection_tomcat:
ParentCommandLine|contains|all:
- /bin/java
- tomcat
selection_websphere:
ParentCommandLine|contains|all:
- /bin/java
- websphere
sub_processes:
Image|endswith:
- /whoami
- /ifconfig
- /ip
- /bin/uname
- /bin/cat
- /bin/crontab
- /hostname
- /iptables
- /netstat
- /pwd
- /route
condition: 1 of selection_* and sub_processes
falsepositives:
- Web applications that invoke Linux command line tools
level: high
license: DRL-1.1
related:
- id: 818f7b24-0fba-4c49-a073-8b755573b9c7
type: derived