Web Server Parented Shell Executing Compound Recon Command from wp-content/plugins

Duo Tech@duotech

•updated Jul 23, 2026•3•0•5

Detects web server processes (Apache, Nginx, PHP-FPM) spawning a system shell to execute compound commands containing discovery utilities (like id, whoami, hostname, uname, or find) within a 'wp-content/plugins' directory. This behavior is indicative of post-exploitation activity following a remote code execution vulnerability, such as those associated with the wp2shell attack pattern.