// Illustrative; not run against live data. CrowdStrike Falcon Next-Gen SIEM (CQL): save as a correlation rule or run in Event Search.
// PHP2Shell web shell in use: PHP executing a script from a folder meant for uploads, caches or temporary files.
// Needs the Linux sensor's PHP visibility (PhpExecuteScript). Add your application's legitimate cache paths to the exclusion.
#event_simpleName=PhpExecuteScript
| TargetFileName=/\/(uploads?|tmp|temp|cache|images?|files|media)\//i
| TargetFileName!=/REPLACE_WITH_LEGITIMATE_CACHE_PATH/
| groupBy([aid, TargetFileName], function=[count(as=Runs), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)])