// Illustrative; not run against live data. CrowdStrike Falcon Next-Gen SIEM (CQL): save as a correlation rule or run in Event Search.
// PHP2Shell post-exploitation: a shell, download tool or reconnaissance command started by a PHP worker or web server.
// Schedule every 15 minutes over the last 20. Events carry the sensor ID (aid): map it to your host inventory.
#event_simpleName=ProcessRollup2
| ParentBaseFileName=/^(php(-fpm|-cgi)?[0-9.]*(\.exe)?|apache2|httpd(\.exe)?|lsphp|frankenphp)$/i
| FileName=/^(sh|bash|dash|zsh|busybox|curl|wget|python3?|perl|ruby|nc|ncat|netcat|socat|base64|whoami|id|uname|cmd\.exe|powershell\.exe|pwsh\.exe|certutil\.exe|whoami\.exe)$/i
| CommandLine!=/REPLACE_WITH_EXPECTED_COMMAND_LINE/
| groupBy([aid, UserName, ParentBaseFileName, FileName], function=[count(as=Runs), collect([CommandLine]), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)])