PHP web server worker creating .php file in web root (php2shell webshell)

Suraj A@cytech

•updated 4 days ago•12•0•15

Detects web server or PHP worker processes (such as php-fpm, httpd, or w3wp.exe) creating, modifying, or renaming .php files within common web root directories, which is a common indicator of web shell deployment or webshell activity.