Web or FTP service process spawning shells or utilities (ProFTPD webshell)
Detects web or FTP server parent processes (such as apache2, httpd, nginx, php-fpm, or proftpd) spawning shell or utility processes (such as bash, sh, python, nc, curl, wget), which is consistent with webshell execution or post-exploitation activities.
Microsoft Sentinel (KQL)
