Shell or downloader spawned by Confluence/GitLab server processes (C3RB3R)
Detects shell or downloader child processes (such as sh, bash, cmd.exe, powershell.exe, curl, or wget) spawned by common server application processes (such as Java, Ruby, Perl, or Exiftool), which may indicate Remote Code Execution (RCE) exploitation such as CVE-2021-26084, CVE-2023-22518, or CVE-2021-22205.
Microsoft Sentinel (KQL)
