Web Shell Detection: Script Process Child of Common Web Processes
Identifies suspicious commands executed via a web server, which may suggest a vulnerability and remote shell access.
CVE search metadata
CVE search record: CVE-2022-22965. Severity: critical. CVSS: 9.8. EPSS: 99.64%. KEV: no. Product: Spring Framework, Cx Cloud Agent, Communications Cloud Native Core Automated Test Suite, Communications Cloud Native Core Console, Communications Cloud Native Core Network Exposure Function, Communications Cloud Native Core Network Function Cloud Native Environment, Communications Cloud Native Core Network Repository Function, Communications Cloud Native Core Network Slice Selection Function +3 more. Brief: Web Shell Detection: Script Process Child of Common Web Processes. Brief link: https://feed.craftedsignal.io/briefs/2026-10-web-shell-detection/
Triage facts
Revision 1- Evidence
- Unknown
- Severity
- High
- Sources
- 4 public sources
- Freshness
- Revision 1Oct 23, 08:17 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- B1Likely
This rule identifies suspicious processes (e.g., cmd.exe, powershell.exe, wmic.exe, curl.exe) launched by common web server applications such as w3wp.exe, httpd.exe, nginx.exe, and others. Such behavior may indicate the exploitation of a vulnerability and the presence of a web shell providing remote access.
False positives may occur during security audits, maintenance, or administrative scripting. Legitimacy should be evaluated by aligning parent context, child identity, command scope, service identity, and available artifact/destination evidence.