PHP SAPI web server process spawning shell child (session.upload_progress RCE)

ills3c Intel&Coffee@Ills3C

•updated today•11•0•16

Detects instances where web server processes or PHP interpreters (apache2, httpd, php-fpm, php) spawn a shell process (sh, bash, dash). This behavior is often indicative of post-exploitation activity such as remote code execution (RCE) via PHP session upload progress or web shell activity.