{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/mono/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["nginx","apache2","httpd","caddy","lighttpd","php-cgi","frankenphp","litespeed","openlitespeed","fcgiwrap","uwsgi","daphne","uvicorn","hypercorn","granian","waitress-serve","flask","puma","unicorn","thin","rackup","mongrel_rails","starman","plackup","twiggy","hypnotoad","starlet","unitd","php-fpm","lsphp","gunicorn","java","node","dotnet","mono","xsp","python","ruby","perl","lua","tomcat","jetty","wildfly","glassfish","resin"],"_cs_severities":["low"],"_cs_tags":["persistence","web-shell","linux","behavioral-detection"],"_cs_type":"advisory","_cs_vendors":["Nginx","Apache Software Foundation","Caddy","LiteSpeed Technologies","PHP","Oracle","Node.js","Microsoft","Mono Project","Python Software Foundation","Ruby","Perl","Lua","Tomcat","Eclipse Foundation","JBoss","GlassFish"],"content_html":"\u003cp\u003eAttackers frequently target public-facing web applications to establish persistence, execute commands, or facilitate command-and-control communication. A common technique involves exploiting a vulnerability to write malicious scripts (such as web shells or backdoored application components) to web-accessible directories. Because web servers legitimatey create and modify files (e.g., during deployments, session management, or cache updates), static detection often leads to high false-positive rates.\u003c/p\u003e\n\u003cp\u003eThis detection approach focuses on identifying deviations from established baseline behavior. By utilizing new term detection (comparing current file creation events against historical data over a seven-day window), defenders can flag anomalous file creation actions initiated by various web server processes, including Nginx, Apache, PHP-FPM, Java, and Node.js. This monitoring targets sensitive directories such as web roots, upload folders, and temporary storage locations where attackers typically land their malicious payloads.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a vulnerability (e.g., unauthenticated file upload, path traversal, or remote code execution) in a public-facing web application.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious payload, such as a PHP, JSP, or ASPX web shell.\u003c/li\u003e\n\u003cli\u003eAttacker sends an HTTP request to the vulnerable endpoint to trigger the writing of the malicious file to the disk.\u003c/li\u003e\n\u003cli\u003eThe web server process (e.g., php-fpm, nginx, or java) performs the write operation in the target directory (e.g., /var/www/html/uploads/shell.php).\u003c/li\u003e\n\u003cli\u003eThe file is successfully written, and the attacker verifies its existence.\u003c/li\u003e\n\u003cli\u003eAttacker initiates an HTTP request to the newly created file to execute system-level commands through the web shell.\u003c/li\u003e\n\u003cli\u003eThe web server interprets the file and executes the embedded code, granting the attacker a persistent foothold.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows attackers to gain unauthorized remote code execution, bypass authentication, exfiltrate sensitive data, and maintain persistent access to the compromised server. This can lead to full system compromise, lateral movement within the network, and the deployment of additional malware, such as ransomware or data exfiltrators.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eDeploy behavioral monitoring to baseline and detect anomalous file creation patterns from web server processes:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eImplement monitoring for the specific file paths identified in the query, including web roots and application upload directories.\u003c/li\u003e\n\u003cli\u003eUtilize the provided detection logic to alert on deviations from historical activity in your SIEM environment.\u003c/li\u003e\n\u003cli\u003eAudit all files created within web directories by server processes for unauthorized scripts or unexpected file extensions.\u003c/li\u003e\n\u003cli\u003eRestrict write permissions for web server service accounts to the minimum required directories to prevent unauthorized file placement.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-03T17:54:08Z","date_published":"2026-07-30T13:32:31Z","id":"https://feed.craftedsignal.io/briefs/2026-07-linux-web-persistence/","summary":"This brief details a behavioral detection strategy for identifying potential web shell deployment and persistence mechanisms by monitoring anomalous file creation activities originating from common web server processes on Linux.","title":"Detection of Unusual File Creation by Web Server Processes on Linux","url":"https://feed.craftedsignal.io/briefs/2026-07-linux-web-persistence/"}],"language":"en","title":"CraftedSignal Threat Feed - Mono","version":"https://jsonfeed.org/version/1.1"}