Apache worker spawning /bin/sh followed by id, curl, wget or php -r children

ills3c Intel&Coffee@Ills3C

•updated 2 days ago•0•0•5

Detects instances where the Apache web server spawns a shell process (sh, dash, bash) which subsequently executes common discovery or callback utilities (such as id, curl, wget, php, hostname, or uname), typically indicative of web application exploitation or remote code execution.