Web Shell Detection: Script Process Child of Common Web Processes

hello@craftedsignal.io — Fri, 23 Oct 2026 08:17:54 +0000

This rule identifies suspicious processes (e.g., cmd.exe, powershell.exe, wmic.exe, curl.exe) launched by common web server applications such as w3wp.exe, httpd.exe, nginx.exe, and others. Such behavior may indicate the exploitation of a vulnerability and the presence of a web shell providing remote access.

False positives may occur during security audits, maintenance, or administrative scripting. Legitimacy should be evaluated by aligning parent context, child identity, command scope, service identity, and available artifact/destination evidence.

Cpe:2.3:a:oracle:communications_cloud_native_core_policy:22.1.0:*:*:*:*:*:*:* - CraftedSignal Threat Feed

Web Shell Detection: Script Process Child of Common Web Processes

Cpe:2.3:a:oracle:communications_cloud_native_core_policy:22.1.0:::::::* - CraftedSignal Threat Feed