NetScaler httpd.conf php_engine enable and cgi-script .pl handler with httpd HUP
Detects potential tampering of Apache HTTP Server configuration files (httpd.conf) involving PHP engine or script handlers, followed closely by an Apache service reload (HUP signal) on the same device within a 10-minute window.
Microsoft Sentinel (KQL)
