php_up_framework.py --syms extracting lsphp heap offsets (PHP2Shell)
Detects the execution of the php-up-2026 framework symbol extraction script (php_up_framework.py) using specific command line flags including --syms and --binary targeting the lsphp binary via python interpreters.
Microsoft Sentinel (KQL)

