Linux Web Server Process Spawning Web Shell Post-Exploitation Utilities

Thiru N@Iamthiru

•updated Sep 7, 2026•5•0•15

Detects execution of common reconnaissance and system discovery commands (e.g., whoami, netstat, ifconfig) initiated by web server or application runtime processes (e.g., httpd, nginx, tomcat, node). This behavior is highly indicative of post-exploitation activity where an adversary attempts to gather system or network information after successfully compromising a web-based service.