// Illustrative; not run against live data. Microsoft Defender XDR advanced hunting, DeviceProcessEvents (Linux web servers with Defender for Endpoint).
// PHP2Shell (CVE-2026-109618, CVE-2026-109619): after exploitation, the PHP worker or web server starts a shell or a download tool.
// Expect noise from applications that call sendmail, convert, git or similar; list them in KnownGood after review.
let Since = datetime(2026-10-20);
let WebServers = dynamic(["REPLACE_WITH_WEB_SERVER_NAME"]);
let KnownGood = dynamic(["REPLACE_WITH_EXPECTED_COMMAND_LINE"]);
DeviceProcessEvents
| where Timestamp > Since
| where DeviceName has_any (WebServers)
| where InitiatingProcessFileName matches regex @"^(php(-fpm|-cgi)?[0-9.]*|apache2|httpd|lsphp|frankenphp)$"
| where FileName in~ ("sh", "bash", "dash", "busybox", "curl", "wget", "python", "python3", "perl", "nc", "ncat", "socat", "base64", "whoami", "id", "uname")
| where not(ProcessCommandLine has_any (KnownGood))
| summarize Runs = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Commands = make_set(ProcessCommandLine, 20)
    by DeviceName, InitiatingProcessFileName, FileName, AccountName
| order by FirstSeen asc
| take 500