Linux Web Server: Suspicious Child Process Execution
This rule identifies suspicious child processes executed via a web server, which may indicate web shell usage, vulnerability exploitation, or unauthorized command execution for persistence.
CVE search metadata
CVE search record: CVE-2022-22965. Severity: critical. CVSS: 9.8. EPSS: 99.64%. KEV: no. Product: Spring Framework, Cx Cloud Agent, Communications Cloud Native Core Automated Test Suite, Communications Cloud Native Core Console, Communications Cloud Native Core Network Exposure Function, Communications Cloud Native Core Network Function Cloud Native Environment, Communications Cloud Native Core Network Repository Function, Communications Cloud Native Core Network Slice Selection Function +3 more. Brief: Linux Web Server: Suspicious Child Process Execution. Brief link: https://feed.craftedsignal.io/briefs/2026-10-linux-web-server-child-execution/
Triage facts
Revision 1- Evidence
- Unknown
- Severity
- Medium
- Sources
- 3 public sources
- Freshness
- Revision 1Oct 23, 14:42 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- B1Likely
Adversaries may exploit vulnerabilities in web applications to execute commands via a web server or deploy web shells to establish persistent access. This detection monitors for web server processes (such as Nginx, Apache, or Java-based application servers) spawning script interpreters, command-line interface programs, or tools associated with reverse shells and system enumeration.