Click2Shell: Web server (php-fpm/apache/nginx) spawns shell after plugin load

Arnold Chan@slaz

•updated Sep 19, 2026•1•0•1

This rule detects when common web server service accounts (e.g., www-data, apache) spawn Unix shell processes (sh, bash, dash) to execute system enumeration commands like 'id' or 'whoami'. This activity is often a sign of post-exploitation behavior following successful web application exploitation, where an attacker attempts to determine their context and privileges on the compromised host.