// Illustrative; not run against live data. CrowdStrike Falcon Next-Gen SIEM (CQL): save as a correlation rule or run in Event Search.
// PHP2Shell persistence that survives the patch: cron, SSH keys, accounts and services changed by the web server account or its children.
#event_simpleName=ProcessRollup2
| UserName=/^(www-data|apache|nginx|httpd|REPLACE_WITH_SITE_ACCOUNT)$/i or ParentBaseFileName=/^(php(-fpm|-cgi)?[0-9.]*(\.exe)?|apache2|httpd(\.exe)?|lsphp|frankenphp)$/i
| FileName=/^(crontab|at|ssh-keygen|useradd|usermod|systemctl)$/i
| groupBy([aid, UserName, ParentBaseFileName, FileName], function=[count(as=Runs), collect([CommandLine]), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)])