Web shell file drop by web server process (Apache/Nginx/PHP-FPM)

Ethan Andrews@eandrews

•updated Aug 4, 2026•6•0•25

Detects the creation of executable script files (PHP, ASP, ASPX, JSP) by web server worker processes (e.g., httpd, nginx, w3wp.exe, php-fpm). This behavior is strongly indicative of the final stage of a web exploitation workflow where an attacker writes a web shell to the server to establish persistence or remote command execution capabilities.