Linux Web Server Process Child Commands Indicative of Webshell Activity

Detects web server processes spawning Linux command-line tools commonly used for host discovery or persistence.

FreeUnreviewedSigmahighv1

linux-web-server-process-child-commands-indicative-of-webshell-activity-818f7b24

title: Linux Web Server Process Child Commands Indicative of Webshell Activity
id: b9bb2f06-d2e3-4710-be09-57e323f130b6
status: test
description: This rule flags Linux process creation where a web server process (httpd/lighttpd/nginx/apache2/node/caddy) spawns child processes with command-line tool or reconnaissance/capability enumeration patterns (e.g., whoami, ifconfig/ip, uname, crontab, netstat, route, iptables, pwd, hostname). Attackers often use webshells to execute system commands through the web service process, making anomalous child process execution a strong behavioral signal. It relies on process creation telemetry that includes parent image/command line and child image paths, matching on both web server parent processes and the specific tool names used by the child.
references:
  - https://www.acunetix.com/blog/articles/web-shells-101-using-php-introduction-web-shells-part-2/
  - https://media.defense.gov/2020/Jun/09/2002313081/-1/-1/0/CSI-DETECT-AND-PREVENT-WEB-SHELL-MALWARE-20200422.PDF
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_webshell_detection.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2021-10-15
modified: 2022-12-28
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  product: linux
  category: process_creation
detection:
  selection_general:
    ParentImage|endswith:
      - /httpd
      - /lighttpd
      - /nginx
      - /apache2
      - /node
      - /caddy
  selection_tomcat:
    ParentCommandLine|contains|all:
      - /bin/java
      - tomcat
  selection_websphere:
    ParentCommandLine|contains|all:
      - /bin/java
      - websphere
  sub_processes:
    Image|endswith:
      - /whoami
      - /ifconfig
      - /ip
      - /bin/uname
      - /bin/cat
      - /bin/crontab
      - /hostname
      - /iptables
      - /netstat
      - /pwd
      - /route
  condition: 1 of selection_* and sub_processes
falsepositives:
  - Web applications that invoke Linux command line tools
level: high
license: DRL-1.1
related:
  - id: 818f7b24-0fba-4c49-a073-8b755573b9c7
    type: derived

What it detects

This rule flags Linux process creation where a web server process (httpd/lighttpd/nginx/apache2/node/caddy) spawns child processes with command-line tool or reconnaissance/capability enumeration patterns (e.g., whoami, ifconfig/ip, uname, crontab, netstat, route, iptables, pwd, hostname). Attackers often use webshells to execute system commands through the web service process, making anomalous child process execution a strong behavioral signal. It relies on process creation telemetry that includes parent image/command line and child image paths, matching on both web server parent processes and the specific tool names used by the child.

Known false positives

Web applications that invoke Linux command line tools

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.