Potential Webshell Process Execution from Web Servers
Detects the execution of `cmd.exe` originating from common web server processes (w3wp.exe, httpd.exe, tomcat.exe) with command-line arguments indicative of a webshell. This rule specifically looks for `cmd.exe /c` invocations where the command is not one of the common benign commands used by web servers, aiming to catch malicious command execution through a webshell.
YARA-L
