Linux web server spawning a shell or network download utility

Siemphony@siemphonymediumT1190unverified

Detects the post-exploitation step of AN0220 on Linux: a web server or an application server that answers requests from the Internet executing a shell, a download utility or a scripting interpreter. A daemon that serves HTTP has no ordinary reason to launch `sh` or `curl`, so this is the strongest single event in MITRE's chain; the request pattern, the 5xx or WAF burst and the outbound callback that bracket it are rate and correlation conditions Sigma cannot state, and no web access log is offered under this analytic in any case, so what is authored here is one link and not the chain. Two shaping notes. The parent match is split because php-fpm installs its binary with the version appended — `/usr/sbin/php-fpm8.2` — so an `endswith` term for it would never fire; that arm uses `contains` instead. And gunicorn and comparable Python-hosted servers are deliberately absent from MITRE's WebProcList as populated here: on an execve record the executable is the interpreter, so such a parent is reported as `/usr/bin/python3` and a name-based term for it is a selector that can never match. The same feed limits the rule elsewhere — the brief's source is auditd SYSCALL execve, which carries the parent as a pid only, so this rule needs a pipeline that resolves the parent's path into ParentImage before it can return anything at all. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0080, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (((InitiatingProcessFolderPath endswith "/apache2" or InitiatingProcessFolderPath endswith "/httpd" or InitiatingProcessFolderPath endswith "/nginx" or InitiatingProcessFolderPath endswith "/lighttpd" or InitiatingProcessFolderPath endswith "/caddy" or InitiatingProcessFolderPath endswith "/node" or InitiatingProcessFolderPath endswith "/uwsgi") or InitiatingProcessFolderPath contains "/php-fpm") and (FolderPath endswith "/sh" or FolderPath endswith "/bash" or FolderPath endswith "/dash" or FolderPath endswith "/zsh" or FolderPath endswith "/ksh" or FolderPath endswith "/curl" or FolderPath endswith "/wget" or FolderPath endswith "/nc" or FolderPath endswith "/ncat" or FolderPath endswith "/netcat" or FolderPath endswith "/socat" or FolderPath endswith "/perl" or FolderPath endswith "/ruby" or FolderPath endswith "/python" or FolderPath endswith "/python3"))

Splunk · SPL

Run this as a search.

index=* (((ParentImage="*/apache2" OR ParentImage="*/httpd" OR ParentImage="*/nginx" OR ParentImage="*/lighttpd" OR ParentImage="*/caddy" OR ParentImage="*/node" OR ParentImage="*/uwsgi") OR ParentImage="*/php-fpm*") AND (Image="*/sh" OR Image="*/bash" OR Image="*/dash" OR Image="*/zsh" OR Image="*/ksh" OR Image="*/curl" OR Image="*/wget" OR Image="*/nc" OR Image="*/ncat" OR Image="*/netcat" OR Image="*/socat" OR Image="*/perl" OR Image="*/ruby" OR Image="*/python" OR Image="*/python3"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (((TO_LOWER(process.parent.executable) LIKE "*/apache2" OR TO_LOWER(process.parent.executable) LIKE "*/httpd" OR TO_LOWER(process.parent.executable) LIKE "*/nginx" OR TO_LOWER(process.parent.executable) LIKE "*/lighttpd" OR TO_LOWER(process.parent.executable) LIKE "*/caddy" OR TO_LOWER(process.parent.executable) LIKE "*/node" OR TO_LOWER(process.parent.executable) LIKE "*/uwsgi") OR TO_LOWER(process.parent.executable) LIKE "*/php-fpm*") AND (TO_LOWER(process.executable) LIKE "*/sh" OR TO_LOWER(process.executable) LIKE "*/bash" OR TO_LOWER(process.executable) LIKE "*/dash" OR TO_LOWER(process.executable) LIKE "*/zsh" OR TO_LOWER(process.executable) LIKE "*/ksh" OR TO_LOWER(process.executable) LIKE "*/curl" OR TO_LOWER(process.executable) LIKE "*/wget" OR TO_LOWER(process.executable) LIKE "*/nc" OR TO_LOWER(process.executable) LIKE "*/ncat" OR TO_LOWER(process.executable) LIKE "*/netcat" OR TO_LOWER(process.executable) LIKE "*/socat" OR TO_LOWER(process.executable) LIKE "*/perl" OR TO_LOWER(process.executable) LIKE "*/ruby" OR TO_LOWER(process.executable) LIKE "*/python" OR TO_LOWER(process.executable) LIKE "*/python3"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,linux,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="ParentImage" type="pcre2">(?i)((/apache2$|/httpd$|/nginx$|/lighttpd$|/caddy$|/node$|/uwsgi$)|/php-fpm)</field>    <field name="Image" type="pcre2">(?i)(/sh$|/bash$|/dash$|/zsh$|/ksh$|/curl$|/wget$|/nc$|/ncat$|/netcat$|/socat$|/perl$|/ruby$|/python$|/python3$)</field>    <description>Linux web server spawning a shell or network download utility</description>    <mitre>      <id>T1190</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / linux
Level: medium
Category: exploitation_initial_access
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: d9fb5e8f-d07d-4fbe-823d-e50942988825

ATT&CKT1190

T1190Exploit Public-Facing Application

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonexploitation initial access

exploitation initial accessAI draft — unreviewed

01 · What this rule detects

A Linux web or application server executing a shell, a download utility or a scripting interpreter. A daemon whose job is answering HTTP has no ordinary reason to launch sh or curl, which makes this the strongest single event in AN0220's chain. That chain is four links — suspicious requests in access logs, a spike of 5xx or WAF blocks, the post-exploitation spawn, an outbound callback. Links one, two and four are rate and correlation conditions Sigma cannot state, and no web access log is offered as a source here in any case. So: one link, deliberately, and the best one available.

02 · Telemetry you need

auditd emits no execve at all by default. Without an explicit
`ParentImage` is not an auditd field. The SYSCALL record carries ppid — a

03 · How the logic works

Two shaping decisions are worth studying, because both avoid selectors that would have validated cleanly and never fired. php-fpm gets its own selection using contains rather than endswith, because distributions install the binary with the version appended — /usr/sbin/php-fpm8.2. An endswith: '/php-fpm' term would look correct in four rendered backends and match nothing forever. gunicorn is in MITRE's WebProcList and is deliberately absent. On an exec record the executable is the interpreter, so a gunicorn worker reports as /usr/bin/python3; a name-based term can never match. Same trap, opposite resolution. Which makes the gap conspicuous. `java` is missing from the parent list, and Java application servers are the largest T1190 exploitation surface on Linux — Struts, Log4Shell, Confluence, Jenkins, WebLogic all end with the JVM spawning /bin/sh. The gunicorn reasoning does not extend to it: a Tomcat webshell execs with exe=/usr/lib/jvm/.../bin/java, a perfectly matchable parent. A Linux T1190 rule without Tomcat is missing the exploit class that made the technique famous — and because gunicorn's exclusion is argued at length while this one is unexplained, it reads as oversight rather than decision. That distinction is the whole reason the reasoning gets written down. The child list has smaller holes of the same kind: /python and /python3 miss the versioned interpreters distributions ship (/usr/bin/python3.11), /php is absent even though php-fpm is a parent (so a webshell calling php -r walks past), and busybox yields a shell under exe=/bin/busybox. Note also what translations.json records: Wazuh refuses this rule, because it cannot OR across different fields in one rule block. That is the cost of the separate php-fpm selection, and the right trade — a correct rule one backend refuses beats a wrong rule it accepts.

04 · Common false positives

PHP applications that shell out by design. shell_exec and proc_open into
PHP and Node apps calling the `curl` or `wget` binaries for webhook
Node `child_process`, build and asset pipelines.
Containers where the web server is PID 1 and supervises the workload, so

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from MITRE ATT&CK DET0080 and never executed against logs.
tier_2: starts by proving the parent field exists: exec anything from your web server and confirm ParentImage arrives populated. Then baseline the per-app shell-out behaviour, which is most of the work.
tier_3: needs the access-log and egress legs joined inside MITRE's TimeWindow — and even then, an in-language webshell using PHP or Node socket APIs never execs a child, so no process-creation rule of any quality will see it.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Add /java, /php, /busybox and a contains term for versioned pythons — coverage before quieting. Then work the noise per application: enumerate which helpers each app legitimately execs and exclude those pairs. That is MITRE's AllowedChildList knob, and its entries are necessarily yours, since which hooks exist is a per-deployment fact.
MITRE's BurstThreshold and TimeWindow knobs describe request-rate and exec-to-egress correlation — no Sigma form, correlation layer only. The SuspiciousPatterns knob (${jndi:, ../, union select) belongs to the Windows analytic AN0219 and applies to web logs this analytic does not offer; know whose analytic you are quoting before it reaches a tuning ticket.
Structurally this is the corpus's Windows T1210 rule on another platform — disjoint parent sets, no query overlap. But this one is medium and T1210 is high for the same behaviour with an equally noisy top false positive. Pick one calibration and apply it to both.

Declared by the author

PHP applications that shell out by design — shell_exec and proc_open calls into ImageMagick, ffmpeg, sendmail, git or a queue worker — which appear as php-fpm launching /bin/sh and are by a wide margin this rule's dominant volume. The exclusion has to be made per application rather than by dropping php-fpm from the parent list, because php-fpm is also where a PHP webshell runs.
Node applications using child_process for the same purposes, plus build and asset pipelines that a long-running node server invokes on demand.
Web server lifecycle scripting: CGI endpoints, mod_cgi and Server Side Includes, log rotation and health-check hooks run as a child of the server process, and certificate renewal jobs that invoke curl or a shell wrapper on a schedule. MITRE names an AllowedChildList knob for these; the entries in it are the estate's own, since which hooks exist is a per-deployment fact.
Container images where the web server is PID 1 and also supervises the workload, so every helper process in the container is a child of it and matches on the parent term alone.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1190, evaluated against their process_creation events.

Share this rule

/u/siemphony/d9fb5e8f-d07d-4fbe-823d-e50942988825

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Linux web server spawning a shell or network download utility

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it