Web shell dropped by web server process then spawning shell (PHP/Node.js)

ills3c Intel&Coffee@Ills3C

•updated 5 days ago•5•0•8

Detects a potential web shell by identifying a web server or runtime process creating or modifying a script file (PHP, JS, MJS) in a web-accessible directory, followed closely by the same web server process spawning a shell or command interpreter.