huntrule

Linux Process Creation Webshell Tooling: Web Server Child Processes Running System Commands

Detects web server processes spawning Linux command-line tools commonly used for host discovery or persistence.

FreeReviewedSigma · High · v2
Product
linux
Category
process_creation
Author
Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2021-10-15
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Persistence

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Linux process creation events where a web server parent process launches a child process matching common reconnaissance and system/administration command paths. Webshell activity often relies on executing OS commands through spawned sub-processes to enumerate the host and persist. It relies on telemetry that records process creation, including the parent image/command line and the child process image.

Reporting behind it

Related detections9 linkedT1505.003 — drag to rearrange
Suspicious Weaver Ant In-Memory Web Shell Marker in Web Request (via webserver)
Malicious Web Server Process Spawning Command Interpreter via Web Shell (via process_creation)
Malicious Web Shell Written to SharePoint LAYOUTS Directory by Worker Process (via file_event)
Malicious IIS Worker Process Spawning Command Shell for Webshell Reconnaissance (via process_creation)
Malicious Command Shell Spawned by SQL Server via Process Creation (via process_creation)
Suspicious PHP Webshell Access with Hardcoded Key
Suspicious IIS Configuration Reconnaissance via Appcmd (via process_creation)
Malicious ManagementMailboxPicker Webshell Written by Diplomatic Specter
Malicious MOVEit human2 Webshell File Creation via file_event
Linux Process Creation Webshell Tooling: Web Server Child Processes Running System Commands
Pivot detection · T1505.003 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.