PHP auto_prepend_file and web shell tampering on Linux web servers (CL-UNK-1211)

Kush rana@Kushblueteamer

•updated 3 days ago•2•0•3

Detects potential web shell installation or PHP configuration tampering in web roots by identifying known web shell hashes, PHP configuration modifications containing auto_prepend_file or auto_append_file directives outside of root, or PHP file creation/modification by web server processes.