Web Server Spawned Suspicious Child Process

rule: Web Server Spawned Suspicious Child Process
desc: 'Detects web server processes spawning suspicious child processes like curl,
  wget, netcat, or scripting interpreters. These often indicate exploitation of web
  application vulnerabilities, where attackers download additional payloads or establish
  network connections. This rule is more sensitive than the shell spawning rule and
  may require tuning in environments where web applications legitimately execute system
  commands. Override the macro user_known_web_server_child_activities for custom tuning.

  '
condition: 'spawned_process and spawned_by_web_server and proc.name in (suspicious_web_children)
  and not proc.name in (shell_binaries) and not proc.cmdline contains "healthcheck"
  and not proc.cmdline contains "status" and not user_known_web_server_child_activities

  '
output: Web server spawned suspicious child process | child=%proc.name web_server=%proc.pname
  gparent=%proc.aname[2] evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid
  command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags
priority: WARNING
tags:
- maturity_sandbox
- host
- container
- process
- mitre_execution
- T1059