Web Shell Child Process Spawn from Web Server Processes

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•2

Detects common web server processes (IIS, Apache, Nginx, PHP, Tomcat) spawning command-line interpreters or utilities (cmd.exe, powershell.exe, wscript.exe, cscript.exe, certutil.exe). This pattern is often indicative of exploitation of a web application to gain command execution on the host.