CWP2Shell: PHP-FPM shell spawn with loopback root API relay on 127.0.0.1:2302

ills3c Intel&Coffee@Ills3C

•updated 7 days ago•7•0•8

Detects potential post-exploitation activity on Linux endpoints where a web/PHP-FPM process spawns a shell executing suspicious commands or deploying a webshell, followed closely by a curl or wget command interacting with the local loopback API.