---
title: Shell spawned by web server or PHP process
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Shell spawned by web server or PHP
  process
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Shell spawned by web server or PHP process
Classification:attackTactic:[TA0003-persistence](https://attack.mitre.org/tactics/TA0003)Technique:[T1505-server-software-component](https://attack.mitre.org/techniques/T1505) 
## Goal{% #goal %}

Detects a shell, HTTP download utility, or shell utility launched by a web server or PHP process.

## Strategy{% #strategy %}

This rule monitors Process Activity Launch events (`@ocsf.class_uid:1007`, `@ocsf.activity_id:1`) where the parent process, reported in `@ocsf.process.parent_process.name` or `@ocsf.actor.process.name`, is `apache2`, `nginx`, `httpd`, `tomcat`, or a `php` interpreter on Linux, or `w3wp.exe` (IIS), `httpd.exe`, `nginx.exe`, `tomcat`, or `php` on Windows. Web servers and PHP applications rarely need to start shells, and a web shell or remote code execution exploit typically runs attacker commands this way. Launching a shell such as `sh`, `bash`, `cmd.exe`, or `powershell.exe`, or a download utility such as `curl` or `wget`, raises a Medium severity signal. Launching a core or reconnaissance utility such as `id`, `uname`, `whoami.exe`, or `systeminfo.exe` raises a Low severity signal. This rule requires parent process information; Linux auditd events do not include it, so this rule does not cover that source.

## Triage and response{% #triage-and-response %}

- Examine `{{@ocsf.process.cmd_line}}` on `{{host}}` to identify the command the web server or PHP process executed.
- Determine whether the web application on `{{host}}` is expected to run system commands, such as for image processing or scheduled maintenance.
- Review web server access logs around the signal time for requests to unusual scripts, file uploads, or exploit payloads.
- Check the web root for recently created or modified script files that could be a web shell.
- Look for follow-on activity from the same parent process, such as downloads, outbound connections, or credential file access.