Webshell Post-Exploitation Activity Detection

SigmaHQ Detections@sigmaHQ

•updated Apr 25, 2025•1•0•23

Detects suspicious child processes spawned by web servers, indicating potential webshell activity used for credential dumping, exfiltration, or other post-exploitation actions. The rule looks for specific command-line patterns and executables commonly associated with these malicious activities originating from known web server processes.