Skip to navigation

Threat reportThreat IntelligenceTL-2026-5730

Vulnerability backlog risk: nearly half of large-enterprise security teams close or deprioritize unverified findings (ProjectDiscovery survey)

MONITORING

A ProjectDiscovery survey reported by Help Net Security on 2026-11-11 finds nearly half of security teams at organizations with 5,000+ employees close or deprioritize vulnerability findings without fully verifying them, citing lack of time. Three in four respondents say their backlog grew over the past year, while Mandiant M-Trends 2026 shows exploitation of vulnerabilities occurring at or before patch availability.

Key facts

IdentifiersTL-2026-5730
SeverityINFO
First disclosed
MalwareSurvey
MITRE ATT&CK techniquesT1190 Exploit Public-Facing Application, T1566.004 Spearphishing Voice, T1588.005 Exploits, T1588.006 Vulnerabilities, T1595.002 Vulnerability Scanning
MotivationUNKNOWN
Target sectorstechnology, finance, enterprise
Target regionsGlobal
Detection rules9 (1 shown free)
Sources10 cited sources

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5730 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Web Server Process Spawning Shell or Recon LOLBin — Exploitation of Public-Facing Application (T1190)

Detects an internet-facing web/application server process (w3wp, httpd, nginx, Tomcat, java, php-cgi) spawning a command interpreter or reconnaissance/download binary. This is the canonical post-exploitation behaviour of T1190 exploitation, which M-Trends 2026 reports as the top initial access vector (32% of intrusions), often before a patch exists. Relevant to TL-2026-5730 where unverified, shelved findings on exposed assets are reached by attackers first. Behaviour-first: no CVE-specific signature required.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1190, T1059
  • Data sources: sysmon, windows_security
  • Severity: high
  • Confidence: medium

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  ```comment TL-2026-5730 T1190: web server worker process spawning interpreter or recon binary```
  (ParentImage="*\\w3wp.exe" OR ParentImage="*\\httpd.exe" OR ParentImage="*\\nginx.exe" OR ParentImage="*\\tomcat*.exe" OR ParentImage="*\\java.exe" OR ParentImage="*\\php-cgi.exe")
  (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\certutil.exe" OR Image="*\\bitsadmin.exe" OR Image="*\\mshta.exe" OR Image="*\\whoami.exe" OR Image="*\\net.exe" OR Image="*\\net1.exe" OR Image="*\\nltest.exe")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentCommandLine) as parent_command_line by host, User, ParentImage, Image
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("w3wp.exe","httpd.exe","nginx.exe","tomcat9.exe","tomcat10.exe","java.exe","php-cgi.exe")
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","certutil.exe","bitsadmin.exe","mshta.exe","whoami.exe","net.exe","net1.exe","nltest.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
| order by Timestamp desc

Sigma

title: Web Server Process Spawning Shell or Recon Binary (Windows)
id: 5b1f0a52-7c3e-4d5a-9f10-6a2b8e4c1d01
status: experimental
description: Detects web server worker processes spawning command interpreters or recon/download LOLBins, indicating exploitation of a public-facing application (TL-2026-5730 / T1190).
references:
    - https://www.helpnetsecurity.com/2026/11/11/security-teams-vulnerability-backlog/
    - https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2026
author: Threadlinqs Team
date: 2026-11-11
tags:
    - attack.initial-access
    - attack.t1190
    - attack.execution
    - attack.t1059
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\w3wp.exe'
            - '\httpd.exe'
            - '\nginx.exe'
            - '\tomcat9.exe'
            - '\tomcat10.exe'
            - '\java.exe'
            - '\php-cgi.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\certutil.exe'
            - '\bitsadmin.exe'
            - '\mshta.exe'
            - '\whoami.exe'
            - '\net.exe'
            - '\net1.exe'
            - '\nltest.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Legitimate application deployment or health-check scripts launched by IIS/Tomcat
    - Admin-initiated maintenance via web-based management consoles
level: high

Known false positives:

  • Legitimate application deployment or health-check scripts launched by IIS/Tomcat
  • Web-based admin consoles that intentionally shell out (backup, diagnostics)

Tuning notes: Allowlist known ParentCommandLine/app-pool and CommandLine pairs for approved health checks; scope to internet-facing hosts via a lookup; raise to critical when Image is powershell/certutil with an HTTP URL.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Vulnerability Scanner Activity Against Web Servers — Active Scanning Precursor to Exploitation · unlock with TL Creds
  • Web Server Process Downloading Payloads via LOLBins — Post-Exploitation Tool Transfer · unlock with TL Creds
  • Remote Support Tool Followed by Script Interpreter — Voice-Phishing Hand-Off · unlock with TL Creds
  • Linux Web Server Process Spawning Shell — Exploitation of Public-Facing Application · unlock with TL Creds
  • Web Server Process Creating Scheduled Task or Service — Persistence After Exploitation · unlock with TL Creds
  • Remote Service Installation via ADMIN$ or PsExec-Style Service — Lateral Movement · unlock with TL Creds
  • Web Shell Dropped in Web Root by Web Server Process — Post-Exploitation Persistence · unlock with TL Creds
  • Periodic Beacon-Like Outbound Traffic from Server Zone — Command and Control · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 13 indicators of compromise for TL-2026-5730.

Sample indicators (1 of 13)

  • URL: hxxps://www[.]helpnetsecurity[.]com/2026/11/11/security-teams-vulnerability-backlog/

Defanged, TLP:CLEAR. Full set of 13 indicators: unlock with TL Creds.

13 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

This is an industry survey / trend report, not a specific exploited vulnerability or campaign. No CVEs, malware families, network indicators, or threat actor attribution are stated in the sources. It is published as vulnerability-management risk context for defenders.

Survey findings reported by Help Net Security (Mirko Zorz, 2026-11-11) from a ProjectDiscovery survey: nearly half of security teams at organizations with 5,000+ employees close or deprioritize findings without fully verifying them, and the reason given is time. Among those teams, 57% say at least three in four of the findings they do check are real. Three in four respondents say their backlog grew over the past year, with a large share of new findings coming from AI testing tools. Most large enterprises have more than 1,000 untriaged findings and about a quarter have more than 10,000. Nearly all respondents say at least one in ten findings is fake or unexploitable, and over a third say it is more than one in four. Seven in ten teams draw findings from three or more sources (scanners, bug bounties, pentests, customer reports); teams with five or more sources are nearly twice as likely as teams with one or two to close findings without full verification. More than half of security leaders admit to closing or deprioritizing unverified findings versus about a third of practitioners. Nearly nine in ten teams that skip verification worry real vulnerabilities are hiding in the backlog, and half of all respondents say hiring more people would not fix the problem. Nearly half say AI is adding findings to their workload, and more than half expect attackers using AI to reach backlog issues before their own teams do. Just over a third say AI helps them triage faster; those teams are less than half as likely to feel bad about their backlog.

Threat-speed context: the article cites Mandiant as reporting an average of 7 days to exploit a vulnerability in 2025 versus 63 days in 2018. Analyst note: Google Cloud's M-Trends 2026 blog (published 2026-03-23) states that the mean time to exploit dropped to an estimated -7 days, meaning exploitation is routinely occurring before a patch is released, and it does not mention the 2018/63-day comparison; the primary report should be checked before citing either figure. The same M-Trends release reports exploits as the most common initial infection vector for the sixth consecutive year (32% of intrusions), global median dwell time rising to 14 days from 11, and the hand-off window between initial access and a secondary threat group collapsing from more than 8 hours in 2022 to 22 seconds in 2025.

Related ProjectDiscovery research (2026 AI Coding Impact Report, 200 practitioners, released 2026-04-22 per press coverage) found 66% of practitioners spend more than half their time manually validating findings instead of fixing vulnerabilities. This is a different survey from the one in the Help Net article; the article does not give the title of the report it draws on. Defensive implication: unverified closed or shelved findings may include exploitable issues that attackers can reach faster than the backlog is triaged, so verification, exploitability-based prioritization, and validation tooling matter.

MITRE ATT&CK techniques by tactic:

Initial Access

T1190 Exploit Public-Facing Application; T1566.004 Spearphishing Voice

Resource Development

T1588.005 Exploits; T1588.006 Vulnerabilities

Reconnaissance

T1595.002 Vulnerability Scanning

Remediation

Immediate actions

  • Prioritize triage of findings on internet-facing assets and anything with known exploitation, ahead of age or scanner severity
  • Audit findings closed or deprioritized without verification and re-validate a sample for exploitability

Workarounds

  • Apply compensating controls (WAF rules, segmentation, access restriction) to exposed systems whose findings cannot yet be verified

Longer-term hardening

  • Adopt exploitability-based prioritization (for example CISA KEV and EPSS) rather than volume-based queues
  • Deduplicate findings across scanners, bug bounty, pentest, and customer-report sources to reduce triage load
  • Use automated validation to confirm real findings; hiring alone was not seen as the fix by half of respondents
  • Report backlog age and unverified-closure rates to leadership as a tracked risk metric

Timeline

  • Year-level baseline: the Help Net article cites Mandiant as reporting an average of 63 days to exploit a vulnerability in 2018 (not found on the Google M-Trends 2026 page; verify against the full report).
  • Year-level: per M-Trends 2026, the median time between initial access and hand-off to a secondary threat group was more than 8 hours in 2022.
  • Year-level: Mandiant 2025 investigations show exploitation at or before patch release (Google states mean time to exploit of an estimated -7 days; Help Net article states 7 days) and a 22-second hand-off window.
  • Google Cloud publishes M-Trends 2026: exploits are the top initial infection vector for the sixth year (32% of intrusions); global median dwell time 14 days.
  • Help Net Security covers M-Trends 2026, highlighting the 22-second access hand-off.
  • ProjectDiscovery releases its 2026 AI Coding Impact Report (200 practitioners); 66% spend more than half their time validating findings.
  • Help Net Security reports the ProjectDiscovery survey: nearly half of 5,000+ employee organizations close or deprioritize unverified findings; three in four report a growing backlog.

Sources cited

Previous and next in threat intel

Drafted by the Threadlinqs research pipeline from 10 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats