Suspicious Child Execution via Web Server

process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and (
  process.parent.name in (
    "nginx", "apache2", "httpd", "caddy", "mongrel_rails", "uwsgi", "daphne", "httpd.worker", "flask",
    "php-cgi", "php-fcgi", "php-cgi.cagefs", "lswsctrl", "varnishd", "uvicorn", "waitress-serve", "starman",
    "frankenphp", "zabbix_server", "asterisk", "sw-engine-fpm"
  ) or
  process.parent.name like ("php-fpm*", "lsphp*", "gunicorn*", "*.cgi", "*.fcgi") or
  (
    process.parent.name like "ruby*" and
    process.parent.command_line like~ ("*puma*", "*rails*", "*passenger*")
  ) or
  (
    process.parent.name like "python*" and
    process.parent.command_line like~ (
      "*hypercorn*", "*flask*", "*uvicorn*", "*django*", "*app.py*", "*server.py*", "*wsgi.py*", "*asgi.py*"
    )
  ) or
  (process.parent.name like "perl*" and process.parent.command_line like~ "*plackup*") or
  (
    process.parent.name == "java" and (
      process.parent.args like~ (
        /* Tomcat */
        "org.apache.catalina.startup.Bootstrap", "-Dcatalina.base=*",

        /* Jetty */
        "org.eclipse.jetty.start.Main", "-Djetty.home=*",

        /* WildFly / JBoss */
        "org.jboss.modules.Main", "-Djboss.home.dir=*",

        /* WebLogic */
        "weblogic.Server", "-Dweblogic.Name=*", "*weblogic-launcher.jar*",

        /* WebSphere traditional + Liberty */
        "com.ibm.ws.runtime.WsServer", "com.ibm.ws.kernel.boot.cmdline.Bootstrap",

        /* GlassFish */
        "com.sun.enterprise.glassfish.bootstrap.ASMain",

        /* Resin */
        "com.caucho.server.resin.Resin",

        /* Spring Boot */
        "org.springframework.boot.loader.*",

        /* Quarkus */
        "*quarkus-run.jar*", "io.quarkus.runner.GeneratedMain",

        /* Micronaut */
        "io.micronaut.runtime.Micronaut",

        /* Dropwizard */
        "io.dropwizard.cli.ServerCommand",

        /* Play */
        "play.core.server.ProdServerStart",

        /* Helidon */
        "io.helidon.microprofile.server.Main", "io.helidon.webserver*",

        /* Vert.x */
        "io.vertx.core.Launcher",

        /* Keycloak */
        "org.keycloak*",

        /* Apereo CAS */
        "org.apereo.cas*",

        /* Elasticsearch */
        "org.elasticsearch.bootstrap.Elasticsearch",

        /* Atlassian / Gerrit */
        "com.atlassian.jira.startup.Launcher", "*BitbucketServerLauncher*", "com.google.gerrit.pgm.Daemon",

        /* Solr */
        "*-Dsolr.solr.home=*",

        /* Jenkins */
        "*jenkins.war*"
      ) or
      ?process.working_directory like "/u0?/*"
    )
  )
) and (
  process.executable like (
    "/tmp/*", "/var/tmp/*", "/dev/shm/*", "./*", "/run/*", "/var/run/*", "/boot/*", "/sys/*", "/lost+found/*",
    "/proc/*", "/var/mail/*", "/var/www/*", "/home/*/*", "/root/*" 
  ) or
  process.name like~ (
    // Hidden processes
    ".*",

    // Suspicious file formats
    "*.elf", "*.sh", "*.py", "*.rb", "*.pl", "*.lua*", "*.php*", ".js", "*.bin", "*.jar", "*.mjs",

    // Network utilities often used for reverse shells
    "nc", "netcat", "ncat", "telnet", "socat", "openssl", "nc.openbsd", "ngrok", "nc.traditional",

    // Cloud CLI
    "az", "gcloud", "aws", "kubectl", "helm", "docker", "ctr", "crictl",

    // Misc. tools
    "whoami", "ifconfig", "ip", "ss", "top", "htop", "du", "lsblk", "lsof", "tcpdump",
    "strace", "ltrace", "curl", "wget", "dig", "nslookup", "host", "nmap", "arp", "traceroute",
    "cat", "touch", "mv", "rm", "mkdir", "ln", "chmod", "sudo", "xxd", "base64", "basez",
    "base64plain", "base64url", "base64mime", "base64pem", "basenc", "base32", "base16", "chpasswd",
    "passwd"
  ) 
) and 
not (
  (
    process.parent.name == "java" and
    process.executable like ("/tmp/CVU_*/exectask*", "/u01/app/*/bin/crsctl.bin", "/u01/app/*/bin/olsnodes.bin")
  ) or
  process.working_directory like ("/u01/*/sysman/emd", "/run/systemd/mount-rootfs") or
  (
    process.parent.executable == "/opt/morpheus/embedded/java/jre/bin/java" and
    process.command_line like (
      "chmod -R g+w /var/opt/morpheus/morpheus-local/repo/git/*",
      "sudo -S -u morpheus-local*"
    )
  ) or
  (
    process.parent.command_line == "/bin/sh /etc/init.d/nginx rotate" and
    process.name == "cat"
  ) or
  (
    process.parent.name == "asterisk" and
    process.executable like (
      "/var/www/html/dialapplet-web/agi/*.php", "/var/lib/asterisk/bin/faxnotify.php"
    )
  ) or
  (
    process.parent.executable == "/home/jiraContractor/jira.install/jre/bin/java" and
    process.executable == "/home/jiraContractor/jira.install/jre/lib/jspawnhelper"
  ) or
  process.parent.args like "/home/agent/Claude/*" or
  (process.parent.executable == "/usr/lib/jvm/java-21-openjdk/bin/java" and process.name == "ln") or
  (
    process.parent.name == "java" and
    process.name == "chmod" and
    process.command_line like ("chmod 00660 /etc/pki/*", "*/u01/app/*")
  )
)

False Positives

• ⚠ Network monitoring or management products may have a web server component that runs shell commands as part of normal behavior.