Reverse shell command lines spawned by PHP worker or web server process
Detects reverse shell constructs (such as /dev/tcp/, fsockopen, or mkfifo) executed in command lines of child processes spawned by web servers or PHP workers, indicating potential post-exploitation activity such as web shell usage.
Microsoft Sentinel (KQL)
