PHP Worker Process Creating PHP Files in Web Root or Upload/Temp Directories

Suraj A@cytech

•updated yesterday•3•0•15

Detects a PHP interpreter or PHP worker process (php-fpm, php-cgi, Apache httpd/apache2, or nginx workers) writing a new PHP-related script file into web root, upload, or temp directories. This is indicative of a webshell drop pattern following an unauthenticated remote code execution vulnerability.