Web server or RT Perl worker spawning shells, downloaders, netcat or Python

ills3c Intel&Coffee@Ills3C

•updated 2 days ago•0•0•1

Detects web servers (httpd, apache2, nginx, php-fpm) or Request Tracker (RT) Perl worker processes spawning suspicious child processes such as shells, downloaders, netcat, or Python interpreters, indicative of post-exploitation or web application compromise.