Web server process spawning shell after web-served file write (web shell chain)

ills3c Intel&Coffee@Ills3C

•updated yesterday•6•0•6

Detects a web server worker process (PHP, Apache, Nginx) writing a script file into a web directory, followed by the same web process spawning a shell process with suspicious command line arguments within 1 hour.