2026 Enterprise Advisory: Defending Against Active Exploitation of Management Interfaces

---
title: Web Server Process Spawning Shell
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
status: experimental
description: Detects web server processes spawning command shells, a common indicator of web shell exploitation.
references:
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|contains:
      - '\apache\'
      - '\nginx\'
      - '\tomcat\'
      - '\java.exe'
      - '\php-cgi.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wsl.exe'
  condition: selection
falsepositives:
  - Legitimate administrative scripts
level: high
---
title: Suspicious File Creation in Web Directories
id: b2c3d4e5-6789-01ab-cdef-234567890bcd
status: experimental
description: Detects creation of executable files or script files within web root directories.
references:
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_create
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\wwwroot\'
      - '\htdocs\'
      - '\html\'
    TargetFilename|endswith:
      - '.asp'
      - '.php'
      - '.jsp'
      - '.exe'
      - '.dll'
  condition: selection
falsepositives:
  - Software updates or legitimate deployment
level: medium

// Hunt for web servers spawning shells
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where InitiatingProcessFileName in~ ("httpd.exe", "nginx.exe", "java.exe", "php-cgi.exe", "tomcat.exe", "w3wp.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "bash", "sh")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, CommandLine, SHA256
| join kind=inner (DeviceNetworkEvents | where Timestamp >= ago(7d) | where RemotePort in (443, 80, 8080, 8443) | project DeviceId, RemoteIP, RemotePort) on DeviceId

-- Hunt for suspicious processes spawned by web services
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime, Parent.Pid AS ParentPid, Parent.Name AS ParentName
FROM pslist()
WHERE ParentName =~ 'nginx'
   OR ParentName =~ 'apache'
   OR ParentName =~ 'httpd'
   OR ParentName =~ 'java'
   OR ParentName =~ 'w3wp'

-- Hunt for recently modified ASP/PHP/JSP files in web roots
SELECT FullPath, Size, Mtime, Mode
FROM glob(globs=['/var/www/**/*.php', '/var/www/**/*.asp', '/var/www/**/*.jsp', 'C:\\inetpub\\wwwroot\\**\\*.asp', 'C:\\inetpub\\wwwroot\\**\\*.php'])
WHERE Mtime > now() - timedelta(hours=24)

# Audit Script: Check for exposed management services and suspicious processes
Write-Host "Starting Security Arsenal Audit..." -ForegroundColor Cyan

# Check for common management service ports listening externally
$netstat = netstat -ano | Select-String "LISTENING"
$suspiciousPorts = @(443, 8443, 8080, 3389, 22)
$exposedServices = @()

foreach ($line in $netstat) {
    $parts = $line -split '\s+'
    $localAddress = $parts[1]
    $port = $localAddress.Split(':')[-1]
    $pid = $parts[-1]
    
    if ($suspiciousPorts -contains $port -and $localAddress -notlike "127.0.0.1*" -and $localAddress -notlike "[::1]*") {
        $process = Get-Process -Id $pid -ErrorAction SilentlyContinue
        $exposedServices += [PSCustomObject]@{
            Port = $port
            Address = $localAddress
            PID = $pid
            ProcessName = $process.ProcessName
            Path = $process.Path
        }
    }
}

if ($exposedServices.Count -gt 0) {
    Write-Host "[!] WARNING: Management services exposed externally:" -ForegroundColor Red
    $exposedServices | Format-Table -AutoSize
} else {
    Write-Host "[+] No common management ports exposed externally." -ForegroundColor Green
}

# Check for web server spawning shell processes
$suspiciousParents = @("w3wp.exe", "httpd.exe", "nginx.exe", "java.exe", "tomcat.exe")
$suspiciousChildren = @("cmd.exe", "powershell.exe", "pwsh.exe")

Write-Host "Checking for suspicious process lineage..." -ForegroundColor Cyan
Get-Process | Where-Object { 
    $suspiciousParents -contains $_.ProcessName 
} | ForEach-Object {
    $parent = $_
    Get-CimInstance Win32_Process | Where-Object { 
        $_.ParentProcessId -eq $parent.Id -and $suspiciousChildren -contains $_.Name 
    } | ForEach-Object {
        Write-Host "[!] CRITICAL: Web process $($parent.Name) spawning shell: $($_.Name)" -ForegroundColor Red
    }
}