Suspicious Web Application Child Process Execution
Detects common web application and application server processes (such as java, node, nginx, or apache) spawning suspicious shell or utility processes. This behavior is often indicative of exploitation of a web vulnerability (e.g., Remote Code Execution) where an adversary attempts to gain a reverse shell or execute post-exploitation commands.
Cortex XDR
