Detection of Suspicious Web Server Child Processes on Linux
This brief provides detection logic to identify potential webshell activity on Linux systems by monitoring for suspicious child processes spawned by common web server applications.
Webshells are commonly used by attackers to maintain persistence and execute commands on compromised web servers. On Linux systems, a strong indicator of compromise is the execution of system administration or reconnaissance tools directly from the web server process (e.g., Apache, Nginx, Node.js). This brief codifies detection logic for identifying when web server parent processes spawn unauthorized child processes, such as 'whoami', 'ifconfig', 'crontab', or network configuration utilities. Defenders should monitor for these patterns to detect unauthorized command execution following initial access or exploit staging. This detection method focuses on process lineage tracking to identify deviations from normal web application behavior.
Impact
Successful exploitation can lead to unauthorized code execution, system reconnaissance, and persistent backdoors on the affected web infrastructure. This pattern helps identify incidents ranging from web-based vulnerability exploitation to post-exploitation lateral movement attempts.
Recommendation
Deploy the provided Sigma rule to your SIEM to monitor for unauthorized sub-process spawning from web server applications. Tune the rule by white-listing legitimate application-specific execution paths to reduce false positives associated with complex web applications that require OS-level utility access.
Immediate actions
Deploy Sigma rule to monitor for suspicious process lineage
Mitigations
Review web server user permissions and restrict execution of unnecessary binaries
T1505.003
Detection coverage 1
Detect Suspicious Linux Web Server Child Processes
highDetects suspicious sub-processes spawned by common web server processes indicating potential webshell activity.
Detection queries are available on the platform. Get full rules →