BIOC
Informational
✕
Web server spawns an unsigned process
Web server processes should normally only carry out tasks related to serving web applications. This instance has spawned an unsigned process, which may indicate a successful exploitation attempt of the associated web application.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Infiltration
- Status:
- Enabled
ATT&CK tactics: Initial Access (TA0001)
ATT&CK techniques: Exploit Public-Facing Application (T1190)
Indicator:
Process action type = execution AND process execution signature = Unsigned , Invalid Signature , N/A Process initiated by = w3wp.exe , httpd.exe , nginx.exe , php-cgi.exe , initiated by = *apache* , *tomcat* Host host os = windows
Preventable: yes