PHP/Web Server Worker Spawning Shell, Interpreter or Download Tool
Detects web server or PHP worker processes spawning command interpreters, shells, or transfer tools, which is indicative of post-exploitation or remote code execution vulnerabilities.
Microsoft Sentinel (KQL)
