Possible Modular Java Backdoor Execution Detection on Modular Cloe MFT (CVE-2024-55956 - via webserver)

Zy Dnz@zydnz

•updated Oct 6, 2025•1•0•68

Detects process creations where parent is cmd.exe or PowerShell.exe and the command line contains . swp, webserver/temp/webserver, -Noninteractive and -EncodedCommand.