PHP/web server worker spawning curl, wget, nc or certutil (PHP2Shell tool downlo
Detects PHP or web server worker processes spawning network or transfer utilities such as curl, wget, nc, or certutil, which is indicative of post-exploitation activity like web shell command execution.
Microsoft Sentinel (KQL)
