Web server process replacing or modifying .bashrc on Linux (CL-UNK-1211)

ills3c Intel&Coffee@Ills3C

•updated yesterday•1•0•1

Detects situations where a web server process (such as PHP, Apache, Nginx) creates or modifies a user's .bashrc profile file, or executes a shell command to write to .bashrc, indicating potential web shell persistence activity.