PHP2Shell form-field exploitation: POST 500, PHP memory exhaustion, Apache worker
Correlates PHP memory exhaustion or heap corruption error messages with subsequent Apache worker crashes (segfaults, aborts, bus errors) on the same host within a 5-minute window to detect potential exploitation attempts.
Microsoft Sentinel (KQL)
