All Detections

Web Shell Command Injection (T1505.003)

avatar
Ibrahim Saud@tektrix
updated Jun 20, 2026002

Detects web server processes (IIS/Nginx) spawning native Windows or Linux shells (cmd.exe, sh), immediately followed by reconnaissance or download tool execution.

Microsoft Sentinel (KQL)