PHP/Web Server Process Spawning Credential and Cloud Metadata Access Commands
Detects process execution events where a web server or PHP worker process spawns a shell or script interpreter that references sensitive files (such as credentials, configuration files, or SSH keys) or queries the cloud instance metadata service.
Microsoft Sentinel (KQL)
