Apache-spawned shell running curl, wget or PHP CLI callback over HTTP

ills3c Intel&Coffee@Ills3C

•updated 2 days ago•4•0•4

Detects web server processes (apache2, httpd) spawning a Unix shell (sh, dash, bash) which subsequently executes curl, wget, or php to perform an external HTTP fetch or download. This behavior is commonly associated with PHP or web application post-exploitation callbacks (webshells).