Web server process spawning shell/recon plus new script file in web root

Arnold Chan@slaz

•updated 3 days ago•4•0•8

Detects potential web shell activity where a web or application server process (such as IIS, Apache, Nginx, or Tomcat) writes a script file (e.g., .aspx, .jsp, .php) into a web-accessible directory, followed shortly by spawning a command-line shell or utility process.