// Illustrative; not run against live data. CrowdStrike Falcon Next-Gen SIEM (CQL): save as a correlation rule or run in Event Search.
// PHP2Shell (CVE-2026-109618): the memory fatal raised before any script runs, in web server error logs ingested as third-party data.
// host.name follows the CrowdStrike Parsing Standard; change it if your parser names the host differently.
"Allowed memory size" "in Unknown on line 0"
| groupBy([host.name], function=[count(as=Events), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)])