Reverse Shell Spawned by Web Application Server Process

Duo Tech@duotech

•updated Jul 30, 2026•0•0•5

Detects a shell process (sh, bash, cmd.exe, powershell.exe) spawned by a web application server process (java, node, python) that establishes an outbound connection to a non-private IP address, excluding known CI/CD and health-check command-line patterns — consistent with a reverse shell delivered via web application exploitation.