Web server process spawning curl/wget/certutil or /dev/tcp reverse shell

ills3c Intel&Coffee@Ills3C

•updated 5 days ago•1•0•5

Detects web server worker processes (such as php-fpm, apache2, nginx, w3wp.exe) spawning download utilities like curl or wget, certutil with transfer flags, or initiating /dev/tcp network connections, which may indicate web application exploitation or webshell activity.