ProFTPD creating script file in web root (SITE CPTO webshell drop)

ills3c Intel&Coffee@Ills3C

•updated 2 days ago•0•0•2

Detects script files (PHP, JSP, etc.) created or renamed within web root directories by the ProFTPD process, indicating potential exploitation of the mod_copy module (CVE-2015-3306) to upload web shells.