Sunturai
Back to results
MediumSplunk security contentRaven Tait +3

Linux Auditd Web or Application Server Spawning a Shell

The following analytic detects instances where Java, web server, or application server processes attempts to spawn a Linux shell, which may indicate exploitation attempts. This detection leverages Endpoint Detection…

Description

The following analytic detects instances where Java, web server, or application server processes attempts to spawn a Linux shell, which may indicate exploitation attempts. This detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process names and parent-child process relationships. This activity may indicate a compromised service leading to unauthorized shell access. If confirmed malicious, attackers could execute commands, escalate privileges, or maintain persistent access.

Detection logic

Detection requirements

Platform
ContainersESXiIaaSLinuxmacOSNetwork DevicesWindows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source category
linux_auditd_syscall

Known benign triggers

  • Filtering may be required on internal developer build systems or classify assets as web facing and restrict the analytic based on asset type.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice