// Illustrative; not run against live data. CrowdStrike Falcon Next-Gen SIEM (CQL): save as a correlation rule or run in Event Search.
// PHP2Shell persistence: a PHP script written to disk by the web server (NewScriptWritten, Linux sensor).
// A CMS update run from the browser writes many files at once; a handful of new files in an uploads folder is the case to chase.
#event_simpleName=NewScriptWritten
| ContextBaseFileName=/^(php(-fpm|-cgi)?[0-9.]*(\.exe)?|apache2|httpd(\.exe)?|lsphp|frankenphp)$/i
| FileName=/\.(php[0-9]?|phtml|phar|pht|inc)$/i
| groupBy([aid, ContextBaseFileName, FilePath], function=[count(as=Files), collect([FileName]), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)])