PHP/Web Server Worker Spawning Shell, Interpreter or Download Tool (php2shell)
Detects web server worker processes (such as PHP-FPM, Apache httpd, etc.) launching shells, interpreters, or download/network tools, which is a common post-exploitation pattern following remote code execution (RCE) vulnerabilities.
Microsoft Sentinel (KQL)
