PHP/web server worker spawning persistence, account creation or webshell file dr
Detects post-compromise persistence activity following PHP Remote Code Execution (RCE), where web server or PHP worker processes spawn commands to create accounts, set up cron jobs, configure scheduled tasks, or write PHP web shell files directly into web server document roots.
Microsoft Sentinel (KQL)
