// Illustrative; not run against live data. Microsoft Sentinel, Syslog table, for web servers that forward Apache, Nginx or PHP-FPM error logs through syslog.
// PHP2Shell (CVE-2026-109618): a successful attempt may leave only a memory-exhaustion fatal error ending "in Unknown on line 0",
// raised while the request starts, before any script runs. Worker crashes (signal 11) around the same time strengthen the signal.
let Since = datetime(2026-10-20);
let WebServers = dynamic(["REPLACE_WITH_WEB_SERVER_NAME"]);
Syslog
| where TimeGenerated > Since
| where Computer has_any (WebServers)
| where (SyslogMessage has "Allowed memory size" and SyslogMessage contains "in Unknown on line 0")
    or SyslogMessage has "exited on signal 11"
    or SyslogMessage has "Segmentation fault"
| extend Signal = iff(SyslogMessage has "Allowed memory size", "startup memory fatal", "worker crash")
| summarize Events = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Sample = take_any(SyslogMessage)
    by Computer, Signal, bin(TimeGenerated, 10m)
| order by FirstSeen asc
| take 500