Linux Web Server Account Privilege Escalation Hunt (Fragnesia/PHP2Shell)

Goksel Atakan@gokselatakan

•updated today•1•0•10

Detects when a web server account (such as www-data, apache, nginx) spawns a shell (bash, sh, etc.), 'su', or 'unshare', which may indicate web application exploitation and post-compromise activity. The query ran without errors in a live tenant.