Management service process spawning shell after inbound connection (VM escape path)

ills3c Intel&Coffee@Ills3C

•updated today•1•0•2

Detects when a shell process (such as sh, bash, dash, cmd.exe, or powershell.exe) is spawned by a metrics, logging, or authentication management service shortly after the service accepts an inbound network connection, potentially approximating exploitation of an internal management service.