AI-Found Vulnerabilities Skew Toward Critical RCE, Google Warns: A Defender's Guide to Detection and Patch Prioritization

---
title: Web Server Process Spawning Shell or Script Interpreter
tid: 8f2a1c94-3b7e-4d5a-9c1f-6e8b2a4d7f31
status: experimental
description: Detects common web server, application server, or database processes spawning shells or script interpreters — a high-fidelity indicator of successful remote code execution exploitation against internet-facing services, including AI-discovered parser and memory corruption flaws.
references:
  - https://www.infosecurity-magazine.com/news/ai-found-vulnerabilities-rce/
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.execution
  - attack.t1190
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\tomcat.exe'
      - '\java.exe'
      - '\javaw.exe'
      - '\node.exe'
      - '\sqlservr.exe'
      - '\php-cgi.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate application server administrative plugins or health-check scripts; baseline per application and exclude known-good command lines
level: high
---
title: Linux Service Process Spawning Shell via RCE Exploitation
id: 3c7d5e21-9a4f-4b68-8d2c-1f5e9a3b6d84
status: experimental
description: Detects Linux web, application, and network service daemons spawning interactive shells or download utilities, consistent with post-exploitation behavior following remote code execution in a network-facing service.
references:
  - https://www.infosecurity-magazine.com/news/ai-found-vulnerabilities-rce/
  - https://attack.mitre.org/techniques/T1190/
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.execution
  - attack.t1190
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/nginx'
      - '/apache2'
      - '/httpd'
      - '/java'
      - '/node'
      - '/php-fpm'
      - '/gunicorn'
      - '/uvicorn'
      - '/postgres'
      - '/mysqld'
      - '/mongod'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/socat'
  condition: selection_parent and selection_child
falsepositives:
  - Application frameworks that legitimately shell out for image processing or PDF generation; exclude by full command-line match after baselining
level: high
---
title: Suspicious Outbound Connection from Web Service Process
id: 5b1e8f47-2c9a-4d35-a7f1-8e6c4b2d9a53
status: experimental
description: Detects web service and application server processes initiating outbound network connections to uncommon external destinations, a strong indicator of post-RCE payload retrieval or command-and-control following exploitation of a code execution flaw.
references:
  - https://www.infosecurity-magazine.com/news/ai-found-vulnerabilities-rce/
  - https://attack.mitre.org/techniques/T1071/
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.exfiltration
  - attack.t1071
  - attack.t1105
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\w3wp.exe'
      - '\java.exe'
      - '\javaw.exe'
      - '\tomcat.exe'
      - '\node.exe'
      - '\nginx.exe'
    Initiated: 'true'
  filter_common_ports:
    DestinationPort:
      - 443
      - 80
  filter_cdn:
    DestinationIp|startswith:
      - '10.'
      - '172.16.'
      - '192.168.'
  condition: selection and not 1 of filter_*
falsepositives:
  - Legitimate outbound API calls and update mechanisms; baseline known destinations per application and alert only on novel IPs
level: medium

// Hunt for RCE exploitation: server processes spawning shells/scripting engines
let suspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe", "rundll32.exe", "certutil.exe", "sh", "bash", "dash", "curl", "wget", "nc", "ncat", "python", "python3", "perl"]);
let serverParents = dynamic(["w3wp.exe", "java.exe", "javaw.exe", "tomcat", "node", "nginx", "apache2", "httpd", "php-fpm", "sqlservr.exe", "postgres", "mysqld", "mongod", "gunicorn", "uvicorn"]);
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ (serverParents)
| where FileName in~ (suspiciousChildren)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, InitiatingProcessRemoteUrl
| extend ChildOfInterest = strcat(InitiatingProcessFileName, " -> ", FileName)
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Occurrences = count(), DistinctHosts = dcount(DeviceName), Hosts = make_set(DeviceName, 10) by ChildOfInterest, ProcessCommandLine
| order by FirstSeen asc;
// Correlate with outbound network connections from the same server processes within 5 minutes
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ (serverParents)
| where FileName in~ (suspiciousChildren)
| extend CorrelationKey = strcat(DeviceName, "|", InitiatingProcessId)
| join kind=inner (
    DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | extend CorrelationKey = strcat(DeviceName, "|", InitiatingProcessId)
    | where RemoteIPType == "Public"
) on CorrelationKey
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, RemoteUrl, RemoteIP, RemotePort
| order by TimeGenerated desc;

-- Hunt for RCE exploitation: service processes with shells/script interpreters as children
-- plus any active outbound connections owned by those service processes
LET suspicious_children = ('cmd.exe', 'powershell.exe', 'pwsh.exe', 'mshta.exe', 'rundll32.exe', 'certutil.exe', 'sh', 'bash', 'dash', 'curl', 'wget', 'nc', 'ncat', 'socat', 'python', 'python3', 'perl')

LET server_parents = ('w3wp.exe', 'java.exe', 'javaw.exe', 'tomcat', 'node', 'nginx', 'apache2', 'httpd', 'php-fpm', 'sqlservr.exe', 'postgres', 'mysqld', 'mongod', 'gunicorn', 'uvicorn')

SELECT Pid AS ChildPid,
       Name AS ChildName,
       CommandLine AS ChildCmdLine,
       CreateTime AS ChildStart,
       Username AS RunAs
FROM pslist()
WHERE Name in suspicious_children
  AND Ppid IN (
        SELECT Pid FROM pslist() WHERE Name in server_parents
      )

UNION

SELECT Pid AS ChildPid,
       Name AS ChildName,
       CommandLine AS ChildCmdLine,
       timestamp(epoch=0) AS ChildStart,
       Status AS RunAs
FROM netstat()
WHERE Name in server_parents
  AND Status = 'ESTABLISHED'
  AND NOT Raddr.IP =~ '^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.|127\\.)'

# Verify Exploit Protection mitigations on high-risk service binaries
$targets = @("w3wp.exe","java.exe","javaw.exe","node.exe","httpd.exe","nginx.exe","tomcat9.exe")
foreach ($t in $targets) {
    $mit = Get-ProcessMitigation -Name $t -ErrorAction SilentlyContinue
    if ($mit) {
        Write-Host "== $t =="
        Write-Host ("  DEP:      " + $mit.Dep.Enable)
        Write-Host ("  ASLR:     " + $mit.Aslr.ForceRelocateImages)
        Write-Host ("  CFG:      " + $mit.Cfg.Enable)
        if ($mit.Dep.Enable -ne 'ON' -or $mit.Cfg.Enable -ne 'ON') {
            Write-Warning "$t missing recommended mitigations — apply via Set-ProcessMitigation"
        }
    }
}

# Check patch recency — flag systems missing updates older than 30 days
$lastHotfix = Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 1
$ageDays = (New-TimeSpan -Start $lastHotfix.InstalledOn -End (Get-Date)).Days
Write-Host ("Last cumulative update installed: " + $lastHotfix.InstalledOn + " (" + $ageDays + " days ago)")
if ($ageDays -gt 30) { Write-Warning "System is over 30 days behind on patches — escalate to emergency patch window" }

# Audit egress: list listening service processes with active external connections
Get-NetTCPConnection -State Established |
  Where-Object { $_.RemoteAddress -notmatch '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.|::1)' } |
  ForEach-Object {
    $p = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    if ($p.Name -in @('w3wp','java','javaw','node','nginx','httpd','tomcat9')) {
        [PSCustomObject]@{ Process = $p.Name; PID = $_.OwningProcess; RemoteIP = $_.RemoteAddress; Port = $_.RemotePort }
    }
  } | Format-Table -AutoSize

# Identify internet-facing services and check for missing hardening flags
for svc in nginx apache2 httpd php-fpm node gunicorn; do
  if systemctl is-active --quiet "$svc" 2>/dev/null; then
    echo "== $svc =="
    systemctl show "$svc" -p NoNewPrivileges,PrivateTmp,ProtectSystem,ProtectHome,RestrictAddressFamilies | tr ' ' '\n'
  fi
done

# Flag any service process with an established connection to a public IP (potential post-RCE C2)
ss -tunp state established | grep -E 'nginx|apache|httpd|java|node|php-fpm' | \
  grep -Ev '(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)' || echo "No suspicious outbound connections from service processes"

# Confirm automatic security updates are enabled (Debian/Ubuntu)
dpkg -l unattended-upgrades >/dev/null 2>&1 && echo "unattended-upgrades installed" || echo "WARNING: unattended-upgrades NOT installed"
grep -q '"1"' /etc/apt/apt.conf.d/20auto-upgrades 2>/dev/null && echo "Auto security updates enabled" || echo "WARNING: verify /etc/apt/apt.conf.d/20auto-upgrades"