PHP FastCGI worker running temp-dir write-execute-delete one-liner (!notwrtbl!)
Detects a PHP FastCGI or web worker process spawning a command line that combines temp-directory probing, file writing, execution, and deletion steps characteristic of a web shell or automated webshell deployment behavior.
Microsoft Sentinel (KQL)
