PHP Worker Spawned Reverse Shell or Reconnaissance Command
Detects web server worker processes or PHP interpreters spawning suspicious child processes associated with reverse shells, network sockets, or reconnaissance commands.
Microsoft Sentinel (KQL)
