Suspicious Child Process Spawned From Web Server

This analytic identifies the execution of suspicious processes, such as `cmd.exe`, `powershell.exe`, or `bash.exe`, when they are spawned by web server processes like `w3wp.exe` or `nginx.exe`. This behavior is a strong indicator of WebShell activity, where an adversary exploits a web application vulnerability to gain persistent access and command execution capabilities on the web server. Successful exploitation could lead to arbitrary command execution, privilege escalation, and data exfiltration.