Webshell Tool Reconnaissance Activity

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•0•0

Detects processes spawned from web servers (PHP, Tomcat, IIS, etc.) that perform reconnaissance looking for the existence of popular scripting tools (perl, python, wget) on the system via the help commands