JDY Botnet: Shell Spawned from Web-Facing Process on Embedded Linux Device

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

This rule detects instances where common web server processes (e.g., httpd, nginx) or system utility services (e.g., sshd, crond, dropbear) spawn shell processes like bash, sh, or ash. This activity is a classic indicator of potential remote command execution (RCE) via web application exploits or the abuse of legitimate system services to run arbitrary commands.