Web server process spawning shell with curl anonymous LDAP recon of domain controller

ills3c Intel&Coffee@Ills3C

•updated 2 days ago•3•0•4

Detects web server processes (such as apache2, httpd, nginx, php-fpm) spawning a shell or curl process that performs LDAP queries using curl against URLs. This activity is indicative of Remote Code Execution (RCE) vulnerabilities being exploited against web applications to perform internal reconnaissance or LDAP enumeration.