Webshell Execution from Web Server Process
This rule detects the execution of known webshells such as Behinder, Neo-reGeorg, Godzilla, or reGeorg. The detection is specifically triggered when these webshells are found in the command line of a process whose parent process is a common web server application like w3wp.exe (IIS), httpd.exe (Apache), nginx.exe (Nginx), or java.exe (often used for Java-based web servers like Tomcat). This indicates potential webshell deployment and execution on a web server, which is a critical indicator of compromise, often associated with initial access or persistence by attackers.
Sigma
