title: Suspicious Process Spawned by Apache Tomcat on Linux
id: 15176efb-9bd7-40f8-9a42-5646f56d0dfd
status: experimental
description: Detects Apache Tomcat spawning shell, network utility, or common discovery processes that can indicate command execution through a web shell.
references:
    - https://cwiki.apache.org/confluence/spaces/WW/pages/327979397/S2-067
    - https://hunter4hunter.tech/blog/strutted/
author: Saad AIDDI (Hunter4Hunter)
date: 2026-08-09
tags:
    - attack.persistence
    - attack.t1505.003
    - attack.execution
    - attack.t1059
logsource:
    category: process_creation
    product: linux
    definition: Requires process creation telemetry with parent image and parent command line fields. Tune the Tomcat command line for the local deployment.
detection:
    selection_parent:
        ParentImage|endswith: '/java'
        ParentCommandLine|contains: 'org.apache.catalina.startup.Bootstrap'
    selection_child:
        Image|endswith:
            - '/sh'
            - '/bash'
            - '/dash'
            - '/curl'
            - '/wget'
            - '/nc'
            - '/ncat'
            - '/socat'
            - '/id'
            - '/whoami'
            - '/uname'
            - '/hostname'
    condition: selection_parent and selection_child
falsepositives:
    - Administrative or application workflows that intentionally launch these utilities from Tomcat. Validate and allowlist known command lines.
level: high