Ivanti Web Server Shell Spawning
Detects suspicious child processes (e.g., shells, network utilities) spawned by the Ivanti EPMM web server process (java, tomcat, httpd). This behavior is a strong indicator of successful remote code execution, often following the exploitation of vulnerabilities like CVE-2026-1281 and CVE-2026-1340.
YARA-L
