defensive-rce

What problem does it solve?

Detect and triage remote code execution attempts targeting web applications by correlating web process spawning, command injection signals, and webshell indicators.

Core Features & Use Cases

• RCE detection: Identify web server process spawning unauthorized system utilities and suspicious child processes.
• Webshell detection: Detect webshell deployment via file changes, YARA matches, and HTTP interactions.
• Threat mapping: Align findings to MITRE ATT&CK T1190, T1505.003, T1059, with Sigma/KQL/YARA artifacts for SOC triage.

Quick Start

Load the full RCE detection methodology against your telemetry to trigger detections and triage incidents.