NGINX Worker Process Spawning Shell, Interpreter, Or Network Tool
Detects an NGINX worker process spawning a shell or interpreter process, the post-exploitation primitive for CVE-2026-42945 (NGINX Rift). The exploit chain corrupts the ngx_pool_t cleanup handler and triggers system() with attacker-controlled shell commands, causing the nginx worker to fork /bin/sh with the -c flag. Since system() always invokes /bin/sh -c, the highest-fidelity match is nginx → /bin/sh -c <command>. Generalizes to catch arbitrary interpreter spawning (bash, python, perl, ruby, netcat variants, socat) which would result from any future post-exploitation pivot. Scoped to Linux because the exploit relies on the fork-based multi-worker architecture (Linux/BSD only). Windows nginx is not affected by the heap feng shui exploitation primitive.
CQL
