Backdoor interactive shell dispatch via execvp/posix_spawnp using shell/kill/upload/stop verbs

Duo Tech@duotech

•updated Jul 2, 2026•1•0•1

Detects execution of specific shell commands (shell, kill, upload, stop) often associated with remote access trojans or backdoors. This rule monitors process creation events where these specific command verbs are present in the command line of either the process itself or its initiator, commonly seen in scenarios where a backdoor receives commands via system execution primitives like execvp() or posix_spawnp().