// Illustrative; not run against live data. CrowdStrike Falcon Next-Gen SIEM (CQL): save as a correlation rule or run in Event Search.
// PHP2Shell follow-on traffic: public connections from processes started by the web server, and from workers started in the search window.
// Long-running PHP workers started before the window are missed; widen the window to 24 hours to include them.
#event_simpleName=NetworkConnectIP4
| cidr(field=RemoteAddressIP4, subnet=["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8", "169.254.0.0/16", "100.64.0.0/10"], negate=true)
| join({#event_simpleName=ProcessRollup2 | FileName=/^(php(-fpm|-cgi)?[0-9.]*(\.exe)?|apache2|httpd(\.exe)?|lsphp|frankenphp)$/i or ParentBaseFileName=/^(php(-fpm|-cgi)?[0-9.]*(\.exe)?|apache2|httpd(\.exe)?|lsphp|frankenphp)$/i}, field=[aid, ContextProcessId], key=[aid, TargetProcessId], include=[FileName, ParentBaseFileName, CommandLine])
| groupBy([aid, ParentBaseFileName, FileName, RemoteAddressIP4, RemotePort], function=[count(as=Connections), collect([CommandLine]), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)])