Web Server Spawning Archive Utilities for Data Staging

Daniel Jeremiah@daniyyell

•updated Jun 19, 2026•2•0•3

Detects PHP or web server processes launching archive and compression utilities. A compromised web application may use these tools to package REDCap files, database exports, credentials, or research data before exfiltration. This behaviour should be rare outside documented backup or deployment activity.