This Linux Auditd-based detection watches for a web or application server process spawning a shell, which can indicate exploitation or post-compromise activity. It ingests Linux Auditd syscall data (EXECVE/PROCTITLE events) via the Splunk Unix and Linux Add-on, normalizes fields to Splunk CIM, and analyzes process relationships to identify a shell launched by a web server process. The search separately tracks commands for common web/server executables (e.g., apache*, nginx, httpd, lighttpd, caddy, tomcat*, java, php*) and for common shells (sh, bash, zsh, dash, ksh, csh, tcsh, fish, rbash, ion, eshell). It creates derived fields for web_process (the parent) and shell_process (the child), along with their PIDs, and then links them by parent PID. The search aggregates results by host and parent PID, and flags a finding when both a web process and a shell process are observed in a parent-child relationship. The alerted finding reports the event as A Linux web or application server process [parent_process_name] spawned shell [process_name] on endpoint [dest], and includes threat objects for the parent and shell processes. The rule maps to MITRE ATT&CK technique T1190 (Exploit Public-Facing Application). It is accompanied by a true-positive test using a sample auditd log, and notes the need for explicit audit rules to capture web-server syscalls (arch-dependent EXE paths), CIM normalization, and adjustment for server variants (nginx, httpd, java, etc.). Potential false positives can arise from legitimate automation or internal builds; filtering by asset type or environment is advised. References include MITRE T1190 and related PHP2Shell analyses. The analytic is designed for Splunk Enterprise/Splunk ES/Splunk Cloud as an Endpoint detection rule.