Oracle WebLogic Server - CraftedSignal Threat Feed

Unusual Child Process Execution by Web Servers on Linux

hello@craftedsignal.io — Mon, 20 Jul 2026 11:50:58 +0000

This brief describes a detection mechanism designed to identify unusual child process executions spawned by web server processes on Linux systems. Attackers frequently exploit vulnerabilities in internet-facing web applications, such as command injection, remote file inclusion, or deserialization flaws, to gain initial access and establish persistence. Once a web server (e.g., Apache, NGINX, or various application servers like those based on Python, Ruby, or Java) is compromised, attackers often leverage its privileges to launch atypical child processes. These child processes might include shells, script interpreters, downloaders like curl or wget, or archive utilities, which deviate significantly from the web server's normal operational behavior. Such activity serves as a strong indicator that the system has been compromised and is being used for further malicious actions like installing backdoors, exfiltrating data, or deploying additional tooling.

Attack Chain

Initial Access: An attacker exploits a vulnerability (e.g., command injection, remote file inclusion, deserialization flaw) in a public-facing web application running on a Linux server.
Web Server Process Execution: The successful exploit causes the compromised web server process (e.g., nginx, apache2, php-fpm, java for a Java application server) to spawn an unusual child process.
Command and Scripting Interpreter Execution: The child process is typically a shell (bash, sh), a scripting interpreter (python, perl, ruby), or a utility designed to execute arbitrary commands.
Payload Delivery: The newly spawned child process executes commands to download additional tools or payloads from attacker-controlled infrastructure using utilities like curl or wget.
Persistence Establishment: Downloaded tools or executed commands establish persistence mechanisms such as web shells (e.g., in /var/www/), new scheduled tasks (cron jobs), modified SSH authorized keys, or system service entries.
Lateral Movement/Data Exfiltration: The attacker uses the persistent access to perform privilege escalation, collect credentials, move laterally within the network, or exfiltrate sensitive data.
Impact: The final objective typically involves full system compromise, data breach, or deployment of further malware such as ransomware.

Impact

Successful exploitation leading to unusual child process execution can result in severe consequences, including full compromise of the affected web server and potentially the broader network. Attackers can leverage the compromised web server's context to install backdoors, escalate privileges, exfiltrate sensitive data, or deploy ransomware. This can lead to significant data breaches, disruption of services, reputational damage, and financial losses. The scope of impact extends to any data handled by the web application or accessible from the compromised server. Without timely detection and remediation, attackers can establish long-term persistence and expand their control over the organization's infrastructure.

Recommendation

Deploy the Sigma rule "Detect Unusual Child Execution by Web Server Process on Linux" to your SIEM and tune for your environment to identify deviations from normal web server behavior.
Review the full parent-to-descendant execution chain for alerts generated by process_creation logs from Linux endpoints to understand the sequence of actions.
Correlate process start times with webserver access, error, reverse-proxy, and WAF logs to identify the triggering request, source IP, requested path, and signs of exploitation like command injection.
Examine activity under the web service account (e.g., process.parent.name related accounts) around the alert for suspicious file writes, new scheduled tasks, privilege escalation attempts, or unusual outbound network_connection logs.
Harden the environment by patching exploited web components, disabling unnecessary script execution from upload and web content directories, enforcing least privilege for web service accounts, and restricting outbound network access.

Unusual Command Execution via Linux Web Server Processes

hello@craftedsignal.io — Mon, 20 Jul 2026 11:45:56 +0000

Attackers frequently leverage compromised Linux web servers as a persistent foothold within an organization's network. This threat involves the exploitation of vulnerable web applications or the deployment of webshells, which then enable the web server process (such as Apache, Nginx, or various application servers like Tomcat or JBoss) to execute arbitrary shell commands. These commands are often "unusual" in the sense that they represent atypical behavior for a web server, indicating malicious activity rather than legitimate web operations. Such command executions can be used to download additional malware (e.g., using wget or curl), establish reverse shells for command and control (e.g., netcat -e sh), or implant new services or cron jobs for long-term persistence. The detection of these activities is crucial as they signify a compromised host that could be used for further lateral movement, data exfiltration, or system-wide impact.

Attack Chain

Initial Access: An attacker exploits a vulnerability in a public-facing web application (e.g., RCE, file upload vulnerability) or drops a webshell onto a web server.
Execution via Web Server: The compromised web server process (e.g., Apache, Nginx, PHP-FPM, or a Java application server) is leveraged to execute a shell command, often using bash -c or similar, to bypass restrictions.
Payload Download: The executed shell command initiates the download of secondary payloads or tools from attacker-controlled infrastructure using utilities like wget or curl.
Local Execution: Downloaded binaries or scripts are made executable (e.g., chmod +x) and then executed from temporary directories or other locations.
Command and Control: The attacker establishes a reverse shell (e.g., nc -e sh /bin/bash) back to their C2 server to gain interactive control over the compromised web server.
Persistence Establishment: Malicious scripts or binaries modify system services, cron jobs, or other startup mechanisms (e.g., systemd units) to ensure continued execution after reboots or service restarts.
Post-Exploitation Activity: With persistent access and C2 established, the attacker proceeds with further objectives, which may include data exfiltration, lateral movement, or deploying ransomware.

Impact

Successful exploitation of web servers through unusual command execution can lead to severe consequences for an organization. Compromised web servers often host sensitive data, critical applications, or serve as a gateway to internal networks. Attackers can leverage this access for full system compromise, data theft, defacement of public-facing assets, deployment of ransomware, or using the server as a staging ground for attacks against other internal systems. The impact can include significant financial losses due to data breaches, operational disruption, reputational damage, and the costs associated with incident response and remediation. The persistence techniques deployed can make detection and eradication challenging, prolonging the recovery process.

Recommendation

Deploy the Sigma rule in this brief to your SIEM and tune for your environment to detect shell execution from web server parent processes.
Configure endpoint logging solutions to capture process_creation events, especially process.parent.name, process.name, process.args, and process.command_line on Linux systems.
Regularly reconstruct the process tree around suspicious events to identify the full chain of execution and any associated files.
Monitor web server access and error logs for anomalies such as unusual POST uploads, long query strings, or HTTP 500 errors corresponding to suspicious command execution timestamps.
Implement file integrity monitoring on common web roots (/var/www, /usr/share/nginx, /srv/http) and application directories to detect newly created or modified files like webshells or backdoors.
Configure network telemetry to detect unusual outbound connections or listeners initiated by web server processes.
Harden web servers by disabling risky exec functions (e.g., PHP exec/system/shell_exec), enforcing noexec, nodev, nosuid mounts on web roots, and applying SELinux/AppArmor confinement.

Suspicious Command Execution via Linux Web Server

hello@craftedsignal.io — Mon, 20 Jul 2026 11:43:05 +0000

Attackers frequently target vulnerabilities in Linux web applications, such as command injection flaws or the deployment of web shells, to gain unauthorized remote code execution. This threat involves a compromised web server process (e.g., Nginx, Apache, PHP-FPM, Java application servers) spawning a shell interpreter (like bash, sh, python) to execute suspicious commands. These commands are often designed for post-exploitation activities, including system enumeration, credential access attempts, establishing persistence, decoding and executing malicious payloads, or setting up reverse shells to attacker-controlled infrastructure. The inherent lack of legitimate reasons for most web server processes to directly invoke shell commands makes such activity a strong indicator of compromise, allowing threat actors to elevate privileges, exfiltrate data, and establish a lasting foothold within the compromised environment.

Attack Chain

Initial Access: An attacker exploits a web application vulnerability (e.g., command injection, deserialization, file upload leading to RCE) on a public-facing Linux web server.
Command Execution: The web server process (e.g., php-fpm, nginx, httpd, java) is forced to execute a shell command, often using -c to run an arbitrary string.
Discovery & Enumeration: The shell command executes initial reconnaissance, such as identifying the user (id, whoami), reading system information (cat /etc/passwd, lsb_release), or checking network configurations (/etc/hosts).
Payload Delivery & Execution: Payloads are downloaded (e.g., via curl, wget) or decoded (e.g., base64 -d, xxd) and then piped directly into an interpreter (e.g., bash, python, php) for execution.
Persistence Establishment: The attacker attempts to establish persistence by modifying cron jobs (crontab), adding SSH keys (/etc/ssh, ~/.ssh), dropping web shells in writable directories (/tmp, /var/tmp), or creating new system services.
Reverse Shell Setup: A reverse shell is initiated using tools like netcat, socat, or /dev/tcp to connect back to an attacker-controlled listener, providing interactive command-and-control.
Credential Access: Attempts are made to access sensitive files such as /etc/shadow or .ssh keys to steal credentials.
Impact: The attacker gains full control over the web server, enabling data exfiltration, lateral movement within the network, or further malicious activities like ransomware deployment.

Impact

Successful exploitation of web application vulnerabilities leading to suspicious command execution can result in a complete compromise of the affected web server. This typically includes unauthorized access to sensitive data (e.g., customer information, intellectual property, credentials), disruption of critical web services, and the establishment of long-term persistence mechanisms, potentially leading to broader network infiltration. Depending on the targeted organization and the data housed on the server, this could incur significant financial losses, reputational damage, regulatory penalties, and a substantial effort for incident response and remediation. No specific victim counts or sectors are mentioned, but the threat is pervasive across any organization operating vulnerable Linux web applications.

Recommendation

Deploy the Suspicious Command Execution via Web Server on Linux Sigma rule to your SIEM to detect immediate threats.
Ensure process-creation logging is enabled on all Linux web servers, specifically capturing host.os.type == "linux" events and event.type == "start" and event.action == "exec" for comprehensive telemetry.
When an alert triggers, review the full process ancestry and execution context of the suspicious command to determine the invoking application component, service account, working directory, and environment variables.
Correlate the execution time of suspicious commands with web server access logs to identify the triggering HTTP request, including source IP, requested URI, parameters, and headers for signs of command injection.
Inspect recently created or modified files in the web root, /tmp, /var/tmp, and /dev/shm directories for dropped scripts, encoded payloads, or other persistence artifacts tied to the command.
Isolate any affected web server from the network immediately upon confirmed unauthorized activity and preserve a forensic snapshot for further investigation.
Patch all web applications and server components to their latest versions, focusing on addressing known vulnerabilities that could lead to remote code execution.