Unix shell spawned by a network-facing service daemon

Siemphony@siemphonymediumT1059.004unverified

A Unix shell running is unremarkable on any Linux host, so the parent is the entire detection: this rule matches sh, bash, dash, zsh, ksh, ash or busybox whose parent is a web, database or file-sharing daemon that has no business execing a shell. That is MITRE's ParentProcess knob from AN1081 ("Shell invoked by unexpected parents (e.g., curl, mail, apache2)"), populated here with a daemon list authored for this rule rather than taken from MITRE. php-fpm and uwsgi are matched with contains rather than endswith on purpose, because the shipped binaries are version-suffixed (php-fpm8.2, uwsgi_python311) and an endswith on the bare name never fires. sshd, cron and login are deliberately absent — a shell under those is the system working normally. Known gap: a service hosted inside an interpreter is not selectable by name here, because the exec is the runtime's — a Tomcat, Jetty or Spring Boot app appears as java and a Gunicorn worker as python3, so an RCE in one of those produces a shell whose ParentImage is the runtime. The osquery socket_events and syslog auth.log legs of AN1081 are not authored: the shell-to-network-discovery chain and the remote-session attribution both need a join across sources within a time window, which lib/sigma has no construct for, and AN1082's macOS leg is macos/unifiedlog with no field schema anywhere in the brief. The rule is written in the Sigma linux process_creation vocabulary (Image, ParentImage); a raw auditd SYSCALL feed carries the same facts as exe= and ppid and needs a field mapping first, and auditd records no execve at all until an explicit execve audit rule is loaded. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0384, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "/sh" or FolderPath endswith "/bash" or FolderPath endswith "/dash" or FolderPath endswith "/zsh" or FolderPath endswith "/ksh" or FolderPath endswith "/ash" or FolderPath endswith "/busybox") and ((InitiatingProcessFolderPath endswith "/httpd" or InitiatingProcessFolderPath endswith "/apache2" or InitiatingProcessFolderPath endswith "/nginx" or InitiatingProcessFolderPath endswith "/lighttpd" or InitiatingProcessFolderPath endswith "/mysqld" or InitiatingProcessFolderPath endswith "/mariadbd" or InitiatingProcessFolderPath endswith "/postgres" or InitiatingProcessFolderPath endswith "/redis-server" or InitiatingProcessFolderPath endswith "/memcached" or InitiatingProcessFolderPath endswith "/vsftpd" or InitiatingProcessFolderPath endswith "/proftpd" or InitiatingProcessFolderPath endswith "/smbd") or (InitiatingProcessFolderPath contains "/php-fpm" or InitiatingProcessFolderPath contains "/uwsgi")))

Splunk · SPL

Run this as a search.

index=* ((Image="*/sh" OR Image="*/bash" OR Image="*/dash" OR Image="*/zsh" OR Image="*/ksh" OR Image="*/ash" OR Image="*/busybox") AND ((ParentImage="*/httpd" OR ParentImage="*/apache2" OR ParentImage="*/nginx" OR ParentImage="*/lighttpd" OR ParentImage="*/mysqld" OR ParentImage="*/mariadbd" OR ParentImage="*/postgres" OR ParentImage="*/redis-server" OR ParentImage="*/memcached" OR ParentImage="*/vsftpd" OR ParentImage="*/proftpd" OR ParentImage="*/smbd") OR (ParentImage="*/php-fpm*" OR ParentImage="*/uwsgi*")))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*/sh" OR TO_LOWER(process.executable) LIKE "*/bash" OR TO_LOWER(process.executable) LIKE "*/dash" OR TO_LOWER(process.executable) LIKE "*/zsh" OR TO_LOWER(process.executable) LIKE "*/ksh" OR TO_LOWER(process.executable) LIKE "*/ash" OR TO_LOWER(process.executable) LIKE "*/busybox") AND ((TO_LOWER(process.parent.executable) LIKE "*/httpd" OR TO_LOWER(process.parent.executable) LIKE "*/apache2" OR TO_LOWER(process.parent.executable) LIKE "*/nginx" OR TO_LOWER(process.parent.executable) LIKE "*/lighttpd" OR TO_LOWER(process.parent.executable) LIKE "*/mysqld" OR TO_LOWER(process.parent.executable) LIKE "*/mariadbd" OR TO_LOWER(process.parent.executable) LIKE "*/postgres" OR TO_LOWER(process.parent.executable) LIKE "*/redis-server" OR TO_LOWER(process.parent.executable) LIKE "*/memcached" OR TO_LOWER(process.parent.executable) LIKE "*/vsftpd" OR TO_LOWER(process.parent.executable) LIKE "*/proftpd" OR TO_LOWER(process.parent.executable) LIKE "*/smbd") OR (TO_LOWER(process.parent.executable) LIKE "*/php-fpm*" OR TO_LOWER(process.parent.executable) LIKE "*/uwsgi*")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,linux,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(/sh$|/bash$|/dash$|/zsh$|/ksh$|/ash$|/busybox$)</field>    <field name="ParentImage" type="pcre2">(?i)((/httpd$|/apache2$|/nginx$|/lighttpd$|/mysqld$|/mariadbd$|/postgres$|/redis-server$|/memcached$|/vsftpd$|/proftpd$|/smbd$)|(/php-fpm|/uwsgi))</field>    <description>Unix shell spawned by a network-facing service daemon</description>    <mitre>      <id>T1059.004</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / linux
Level: medium
Category: script_interpreter_execution
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: e9e26c24-621b-4c22-a0ad-d61d65ca1820

ATT&CKT1059.004

T1059.004Unix Shell

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonscript interpreter execution

script interpreter executionAI draft — unreviewed

01 · What this rule detects

A Unix shell whose parent is a network-facing service daemon — the shape of a web shell, an SQL-to-OS escape, or a foothold taken straight after remote exploitation. A shell running is unremarkable on any Linux host, so the parent process is the entire detection; nothing about the shell itself is suspicious. This covers the process-execution leg of AN1081 under DET0384.

02 · Telemetry you need

Linux process creation carrying Image and ParentImage — Sysmon for Linux, or an auditd pipeline mapping exe= and ppid into those fields. auditd emits no execve at all until an explicit execve audit rule is loaded. AN1081's osquery socket_events and auth.log legs are not authored: both need a join across sources inside a time window, which lib/sigma has no construct for. AN1082's macOS leg has no field schema anywhere in the brief.

03 · How the logic works

The condition is selection_shell and (selection_parent_daemon or selection_parent_versioned). selection_shell is Image|endswith on /sh, /bash, /dash, /zsh, /ksh, /ash, /busybox. Both dash and bash are listed because /bin/sh is a symlink that resolves differently on Debian and RHEL; busybox covers busybox sh. selection_parent_daemon is ParentImage|endswith on httpd, apache2, nginx, lighttpd, mysqld, mariadbd, postgres, redis-server, memcached, vsftpd, proftpd, smbd. selection_parent_versioned uses ParentImage|contains on /php-fpm and /uwsgi — contains rather than endswith because the shipped binaries are version-suffixed (php-fpm8.2, uwsgi_python311) and an endswith on the bare name would never fire. MITRE supplies the knob: AN1081's ParentProcess, "Shell invoked by unexpected parents (e.g., curl, mail, apache2)". The daemon list itself is the pipeline's own, extrapolated from that single example. sshd, cron and login are absent on purpose — a shell under those is the system working normally.

04 · Common false positives

PHP applications that shell out by design — WordPress and Nextcloud cron, ImageMagick and ffmpeg thumbnail helpers, sh -c mysqldump backup plugins under php-fpm — are the highest-volume match on any CMS or shared-hosting estate. PostgreSQL's archive_command runs through /bin/sh once per WAL segment. mod_cgi scripts make httpd the parent of /bin/sh on every request. Samba VFS and print commands and vsftpd upload hooks are configured as shell strings. Apache piped logging (CustomLog "|/usr/bin/rotatelogs ...") produces an httpd-parented shell on every start, graceful restart and rotation — in quiet windows, where an analyst is most inclined to trust the alert.

05 · Detection maturity

tier_1: Lowest tier, and it stays there until this has been run against real data. It has never touched a log line: the parent list is authored, not validated, and redis-server and memcached are carried for completeness even though neither has a documented way to exec a child — real Redis abuse surfaces later as a cron- or sshd-parented shell this rule does not match. Deploy it in count mode, look at what your daemon parents actually spawn, and rebuild the list from that.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

level: medium reflects that. Rather than tuning the whole rule down, split it: drop the php-fpm leg to informational on PHP-hosting boxes and keep the database and file-sharing parents at medium, since mysqld or smbd spawning a shell is genuinely rare. Then use AN1081's other MITRE knobs — UserContext and CommandLinePattern (pipes, &&, download commands, reverse-shell one-liners) — as promotion criteria rather than as filters.
Know the gate's limits. One intermediate generation defeats it: suexec, systemd-run, a cgi dispatcher, or a dropper that execs perl which execs sh all leave the intermediary as ParentImage. Interpreter-hosted services show the runtime, not the application: a Tomcat or Confluence web shell has java as parent — selectable, but it does not say which app was exploited. The overlap is deliberate; the web-daemon parents are already carried by the corpus's T1190 rule as exploitation and are repeated here only so the shell-execution tag exists.

Declared by the author

Web applications that shell out by design from PHP — WordPress, Nextcloud and Magento cron runners, ImageMagick and ffmpeg thumbnail helpers, and backup plugins that call sh -c mysqldump, all reached through exec() or shell_exec() under php-fpm. On a CMS or shared-hosting box this is the highest-volume match by a wide margin and fires on the application's own schedule rather than on human activity.
PostgreSQL archive_command and restore_command, which the archiver process runs through /bin/sh once per WAL segment, so a busy database emits a steady stream of postgres-parented shells that no operator ever sees.
Apache mod_cgi and suexec serving shell CGI scripts, where a .sh or .cgi file with a #!/bin/sh shebang makes httpd or apache2 the parent of /bin/sh every time the page is requested.
Samba print and VFS commands and vsftpd upload hooks, which are configured as shell command strings and are therefore executed as a child shell of smbd or vsftpd on every matching client operation.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1059.004, evaluated against their process_creation events.

Share this rule

/u/siemphony/e9e26c24-621b-4c22-a0ad-d61d65ca1820

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Unix shell spawned by a network-facing service daemon

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it