Execution From Webserver Root Folder

Detects a program executing from a web server root folder. Use this rule to hunt for potential interesting activity such as webshell or backdoors