Detect BADHATCH by looking for attacker-controlled execution on internet-facing systems, especially unusual web requests followed by shell or script activity. Monitor for new processes that appear after a server-side exploit, unexpected child processes from web services, and outbound connections initiated by those processes. Pair endpoint telemetry with web logs and authentication records to separate normal application behaviour from compromise.
What BADHATCH detection looks like in practice
BADHATCH is easiest to spot when endpoint behaviour and web-layer activity line up. Security teams should treat a web server as suspicious when a request is followed by a new shell, script interpreter, or unexpected child process, especially if the process tree does not match the application’s normal runtime pattern. The goal is to identify attacker-controlled execution, not just web traffic anomalies.
That usually means building detections around process creation, parent-child relationships, command-line content, and network activity from the same host. A single unusual request is weak signal on its own; a request that is followed by execution and then outbound connections from the spawned process is much stronger evidence of compromise.
For web-facing systems, this is where endpoint telemetry becomes more useful than generic perimeter alerts. Web logs can show the triggering request, while authentication records can help distinguish administrative activity from an exploit path. NIST Cybersecurity Framework 2.0 is useful here because detection depends on correlating events, not on any single indicator.
Telemetry patterns that matter most
The highest-value patterns are those that show a chain from exposure to execution. Look for web services spawning shells, scripting engines, archive tools, or other utilities that the application normally should not launch. Also watch for short-lived processes that immediately make outbound connections, because that often indicates the payload is trying to call back to an operator, fetch staging material, or pivot to another host.
Command-line telemetry is important because many attacks leave traces there even when file-based indicators are sparse. Unexpected arguments, encoded commands, or processes launched from temporary directories can help distinguish legitimate application activity from post-exploitation behaviour. Correlating that with the timing of the inbound request gives you a better chance of catching the compromise at the first execution step.
Network telemetry should focus on destination rarity, first-seen outbound connections, and process-attributed connections from the web host. If the web service itself normally talks only to internal dependencies, any new external connection from a child process should be treated as a high-priority lead. For a practical detection baseline, the MITRE ATT&CK Enterprise Matrix is useful for mapping what the host did after initial exploitation.
How to reduce false positives without missing compromise
Normal application behaviour is your main source of false positives, so detections need an allowlist built from observed service behaviour, not assumptions. Some web platforms legitimately invoke helper binaries, scripts, or background jobs, and those should not trigger every time. What matters is whether the process, user context, and outbound activity are consistent with the service’s expected runtime profile.
A good triage rule is to ask whether the process chain could reasonably exist during ordinary application operation. If the answer is no, or if the chain appears only after a specific internet-facing request, elevate it. This is especially important when the web application has file upload, deserialisation, template rendering, or command execution features, because those increase the chance that a request can turn into code execution.
When possible, enrich detections with host role, exposed service inventory, and known administrative windows. That helps separate maintenance from exploitation, especially on systems that are patched or restarted frequently. The more precise your baseline, the easier it becomes to spot the small but important behaviours that indicate a BADHATCH-style intrusion.
Risk and Threat Considerations
BADHATCH-style activity is risky because the first visible sign may already be post-exploitation execution on a server that is directly reachable from the internet. Once a request can trigger a shell or script, the attacker can often move quickly from initial access to staging, persistence, or lateral movement.
Failure mechanism: Monitoring that stops at request logs or high-level alerting misses the host-level execution chain, so the exploit looks like normal web traffic until the payload has already run.
Impact: Defenders can lose the window for containment, especially if the spawned process is allowed to make outbound connections or touch credentials, local secrets, or adjacent systems before it is detected.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | DE.CM-01 — Networks and systems are monitored to detect potential cybersecurity events | BADHATCH detection depends on monitoring host and network telemetry for suspicious execution chains. |
| Recommendation — Correlate endpoint and network events to detect suspicious execution after web requests. | ||
| MITRE ATT&CK | T1059 — Command and Scripting Interpreter | BADHATCH commonly manifests through shell or script execution after initial web compromise. |
| T1105 — Ingress Tool Transfer | Outbound connections from spawned processes can indicate staging or payload retrieval after compromise. | |
| Recommendation — Map observed shell or script activity to T1059 and hunt for post-exploit command execution. Look for process-attributed outbound connections that suggest payload transfer or staging. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | The question requires correlating logs and telemetry to detect exploitation and execution paths. |
| Recommendation — Centralise and review web, endpoint, and authentication logs for correlated compromise signals. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Review, Analysis, and Reporting | BADHATCH detection relies on analysis of logs and telemetry to identify exploit chains. |
| Recommendation — Review correlated logs for execution after web requests and escalate suspicious host activity. | ||
Practitioner Guidance
What to prioritise: Correlate web requests, process creation, and outbound connections on the same host first, because that sequence is the most reliable way to distinguish exploit traffic from normal application noise. If you only have one telemetry source, prioritise endpoint process telemetry over request volume.
What to verify: Confirm the expected parent-child process tree for each internet-facing service, then verify whether any new child process appears only after a suspicious request or on an unusual schedule. Also check whether the outbound destination is normal for that process, not just for the server overall.
Practitioner takeaway: The strongest BADHATCH detections are behavioural, not signature-based, because the decisive clue is the transition from web request to execution to outbound activity on a host that should not behave that way.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org