Web Server Process Spawning Non-Shell Interpreter or Downloader from WordPress Content Path

Duo Tech@duotech

•updated Jul 23, 2026•0•0•0

Detects a WordPress-context web server process spawning a non-shell interpreter or downloader (curl|bash, python -c, wget/curl via sh -c) to retrieve second-stage tooling post-exploitation.