ShapedPlugin - w3wp.exe Executing PHP Command Line
Detects w3wp.exe directly passing backdoor files as command line arguments to a PHP runtime. This activity is indicative of a supply chain compromise where malicious PHP files are executed by the IIS worker process.
Microsoft Sentinel (KQL)
