Shell Spawned as Child of FFmpeg, Jellyfin, or Nextcloud Media Service
Detects the spawning of /bin/sh or /bin/bash as a direct child process of ffmpeg, jellyfin, or nextcloud. This behavior is often indicative of exploitation attempts against these media and storage services, potentially leveraging remote code execution vulnerabilities.
YARA-L
