Recon commands (whoami, id, uname -a, ipconfig) spawned by PHP/web server proces

Suraj A@cytech

•updated 4 days ago•2•0•5

Detects quick reconnaissance commands (such as whoami, id, uname, ipconfig) executed directly by a web server worker (e.g., PHP-FPM, Apache httpd) or via a shell child process of the web server worker, indicative of post-exploitation activity like php2shell.