Reverse shell command lines spawned by PHP/web server worker (php2shell)
Detects the execution of reverse shell commands, interpreters, or utilities (such as Netcat, Python, or bash using /dev/tcp) spawned from web server worker processes or script interpreters, which is typically indicative of a web shell or remote code execution exploitation.
Microsoft Sentinel (KQL)
