Anomalous PHP Web Shell Execution
This rule detects the execution of PHP with command-line arguments indicative of web shells like 'aws.php' and 'file_save.php', which have been used in the exploitation of CVE-2026-1731. The detection looks for the use of eval with base64 decoding and specific, non-standard parameters used to pass commands.
Microsoft Sentinel (KQL)
