PolyShell Webshell Activity and C2 Communication

This rule detects PolyShell webshell activity on Linux systems, specifically targeting Magento e-commerce platforms. It identifies processes executing from or targeting a suspicious media directory (`/var/www/prod/shared/pub/media/custom_options/quote/i/n/`) in conjunction with `curl` processes retrieving payloads from the `gsocket.io` C2 network. The detection logic combines indicators of webshell presence (execution from a specific directory) with C2 communication (curl to gsocket.io).