This detection rule identifies suspicious child process executions originating from web server processes on Linux systems, indicating that attackers may have exploited web application vulnerabilities such as command injection or remote file inclusion to establish persistence or execute malicious commands.
Elastic Defend +45
persistence
execution
command-and-control
initial-access
linux
webserver
webshell
privilege-escalation
+4
2r
5t
13i
updated