Discovery commands spawned by PHP or web-server processes (PHP2Shell)

ills3c Intel&Coffee@Ills3C

•updated 3 days ago•7•0•10

Detects when typical discovery commands (whoami, id, uname, ipconfig) are executed under a web server or PHP process parent, potentially indicating post-exploitation activity following a web application compromise. The rule aggregates distinct commands within a 15-minute window to reduce false positives.