Skip to content
Threat Feed

Tag

OS: Linux

1 brief RSS
high threat

Suspicious Web Server Child Process Execution via Elastic Defend for Containers

This rule detects the exploitation of a web server through the execution of a suspicious process by common web server user accounts within a containerized environment, potentially indicating the uploading of a web shell to maintain system access, and covers persistence, execution, and command and control tactics.

Elastic Defend for Containers Data Source: Elastic Defend for Containers Domain: Container OS: Linux Use Case: Threat Detection Tactic: Persistence Tactic: Execution Tactic: Command and Control Resources: Investigation Guide
2r 3t