JBoss

A Chinese-speaking threat actor is leveraging a triad of autonomous AI agents (Strix, Cairn, and Hermes) to conduct vulnerability research, exploitation, and data exfiltration against hundreds of online retail platforms.

This brief details a behavioral detection strategy for identifying potential web shell deployment and persistence mechanisms by monitoring anomalous file creation activities originating from common web server processes on Linux.

This rule detects unusual child process executions originating from web server processes on Linux systems, which attackers may use to maintain persistence on a compromised system by exploiting web server vulnerabilities.

Identifies suspicious command executions via a web server on Linux systems, which may suggest a vulnerability and remote shell access.