3BB: Web Shell Activity: Suspicious Shell/Interpreter Spawned by Web Server
Detects web server processes (e.g., w3wp.exe, nginx.exe, tomcat.exe) spawning command-line interpreters or utilities that could indicate remote code execution, web shell activity, or post-exploitation discovery/download attempts.
Microsoft Sentinel (KQL)
