ColdFusion Process Spawning Child Processes Indicating Webshell Re-Access
Detects instances where ColdFusion service processes or IIS worker processes (w3wp.exe) spawn common command-line interface tools or system enumeration utilities. This activity often indicates post-exploitation behavior, such as a web shell being used to execute commands, perform system discovery, or establish persistent re-access after initial remediation.
YARA-L
