Web-Server-Spawned Shell Running Recon or SUID/SGID Enumeration Commands from WordPress Plugins Path

Duo Tech@duotech

•updated Jul 23, 2026•0•0•5

Detects discovery and SUID/SGID enumeration commands (whoami, hostname, id, uname, cat /etc/passwd, find -perm) executed by a shell spawned from a WordPress plugins directory by a web server process.