Post-Exploitation Process Execution via cPanel Daemon (CVE-2026-41940)
Detects suspicious command execution originating from cPanel daemons. This rule identifies instances where cPanel processes (cpsrvd, cpsrvd-ssl, cpaneld, whostmgrd) or their immediate children execute common shell interpreters or specific commands indicative of potential compromise, such as writing to /etc/passwd, modifying authorized_keys, or using base64/perl/python/bash for interactive shells.
Microsoft Sentinel (KQL)
