GitLab application service (Puma/Sidekiq/Rails) spawning shell child process

ills3c Intel&Coffee@Ills3C

•updated today•0•0•2

Detects GitLab backend processes (such as puma, sidekiq, rails, ruby, bundle) spawning shells, scripting interpreters, or network tools with suspicious command-line parameters, potentially indicating post-exploitation activity or vulnerability exploitation.