Web server or PHP worker process spawning a shell or interpreter

ills3c Intel&Coffee@Ills3C

•updated 6 days ago•0•0•5

Detects web server processes (such as apache2, nginx, httpd, php-fpm, or w3wp.exe) spawning shell interpreters (such as bash, sh, cmd.exe, or powershell.exe), which is a common indicator of web shell activity or application exploitation.