Suspicious Process Spawned by Web Server
Detects potentially suspicious processes being spawned by a web server process which could be the result of a successfully placed web shell or exploitation. This rule specifically looks for common web server processes (Caddy, Apache HTTPD, Nginx, PHP, Tomcat, IIS, Exchange UMWorkerProcess) or Java processes identified as Tomcat, spawning anomaly children processes like command-line interpreters (cmd.exe, powershell.exe, bash.exe), network utilities (net.exe, netsh.exe), or other system utilities often used in post-exploitation.
Sigma
