Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

HuntCONSTRUCTEDMembers

Hunt: a web server process starting a shell or a reconnaissance tool

IIS, Apache, nginx and Java application servers do not normally start cmd, PowerShell or a Unix shell. When they do, it is the most reliable sign of a web shell in use, on Windows and Linux alike.

PersistenceT1505.003T1190checked 2026-09-26

Written for

  • KQL, Microsoft Defender XDR
  • SPL, Splunk with Sysmon
  • Elastic, EQL, Elastic Defend on Windows and Linux

Needs

  • Process creation with parent process and command line: Defender for Endpoint, Sysmon event 1, or Elastic Defend and auditd on Linux

sources

  1. MITRE ATT&CK T1505.003, Server Software Component: Web Shell · primary
  2. NSA Cybersecurity: mitigating web shells
  3. Microsoft Learn: the DeviceProcessEvents table in advanced hunting

Tags: hunting · webshell · iis · apache · nginx · linux · windows · sentinel · splunk · elastic · T1505.003