php-fpm web shell spawning sh to read passwd/shadow via renamed interpreters

ills3c Intel&Coffee@Ills3C

•updated yesterday•3•0•5

Detects behavior where a php-fpm process spawns a command shell (sh, dash, bash) to access credential files like /etc/passwd or /etc/shadow, or invoke known renamed interpreter payloads alongside setuid/setgid patterns.