Web Shell Command Injection Cascade
Detects web server processes (IIS/Nginx) spawning native Windows or Linux shells (cmd.exe, sh, bash), immediately followed by reconnaissance or download tool execution (whoami.exe, ping.exe, certutil.exe, curl, wget) within a 2-minute window. This pattern is indicative of a web shell being used for initial system compromise and subsequent information gathering or tool deployment.
Microsoft Sentinel (KQL)
