Unusual Child Process Execution by Web Servers on Linux

This brief describes a detection mechanism designed to identify unusual child process executions spawned by web server processes on Linux systems. Attackers frequently exploit vulnerabilities in internet-facing web applications, such as command injection, remote file inclusion, or deserialization flaws, to gain initial access and establish persistence. Once a web server (e.g., Apache, NGINX, or various application servers like those based on Python, Ruby, or Java) is compromised, attackers often leverage its privileges to launch atypical child processes. These child processes might include shells, script interpreters, downloaders like curl or wget, or archive utilities, which deviate significantly from the web server's normal operational behavior. Such activity serves as a strong indicator that the system has been compromised and is being used for further malicious actions like installing backdoors, exfiltrating data, or deploying additional tooling.

Attack Chain

1. Initial Access: An attacker exploits a vulnerability (e.g., command injection, remote file inclusion, deserialization flaw) in a public-facing web application running on a Linux server.
2. Web Server Process Execution: The successful exploit causes the compromised web server process (e.g., nginx, apache2, php-fpm, java for a Java application server) to spawn an unusual child process.
3. Command and Scripting Interpreter Execution: The child process is typically a shell (bash, sh), a scripting interpreter (python, perl, ruby), or a utility designed to execute arbitrary commands.
4. Payload Delivery: The newly spawned child process executes commands to download additional tools or payloads from attacker-controlled infrastructure using utilities like curl or wget.
5. Persistence Establishment: Downloaded tools or executed commands establish persistence mechanisms such as web shells (e.g., in /var/www/), new scheduled tasks (cron jobs), modified SSH authorized keys, or system service entries.
6. Lateral Movement/Data Exfiltration: The attacker uses the persistent access to perform privilege escalation, collect credentials, move laterally within the network, or exfiltrate sensitive data.
7. Impact: The final objective typically involves full system compromise, data breach, or deployment of further malware such as ransomware.

Impact

Successful exploitation leading to unusual child process execution can result in severe consequences, including full compromise of the affected web server and potentially the broader network. Attackers can leverage the compromised web server's context to install backdoors, escalate privileges, exfiltrate sensitive data, or deploy ransomware. This can lead to significant data breaches, disruption of services, reputational damage, and financial losses. The scope of impact extends to any data handled by the web application or accessible from the compromised server. Without timely detection and remediation, attackers can establish long-term persistence and expand their control over the organization's infrastructure.

Recommendation

• Deploy the Sigma rule "Detect Unusual Child Execution by Web Server Process on Linux" to your SIEM and tune for your environment to identify deviations from normal web server behavior.
• Review the full parent-to-descendant execution chain for alerts generated by process_creation logs from Linux endpoints to understand the sequence of actions.
• Correlate process start times with webserver access, error, reverse-proxy, and WAF logs to identify the triggering request, source IP, requested path, and signs of exploitation like command injection.
• Examine activity under the web service account (e.g., process.parent.name related accounts) around the alert for suspicious file writes, new scheduled tasks, privilege escalation attempts, or unusual outbound network_connection logs.
• Harden the environment by patching exploited web components, disabling unnecessary script execution from upload and web content directories, enforcing least privilege for web service accounts, and restricting outbound network access.