Webshell Tool Reconnaissance Activity

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

Detects processes spawned from web servers (PHP, Tomcat, IIS, etc.) that perform reconnaissance looking for the existence of popular scripting tools (perl, python, wget) on the system via the help commands. This activity is often associated with webshells attempting to understand the capabilities of the compromised server.