AhsayCBS - Web Service Spawns Shell Interpreter
Detects an AhsayCBS / Tomcat / Java web service process spawning a command or script interpreter. After exploiting AhsayCBS, attackers executed shell commands through the dropped webshell to run reconnaissance and download the XMRig payload. A backup web service should never directly spawn cmd.exe, powershell.exe, or a Unix shell - this indicates webshell command execution.
YARA-L
