Web Server Launching Obfuscated or Encoded Commands
Detects PHP or web server processes launching interpreters with encoded, Base64-decoded, or dynamically evaluated command content. This behavior is often indicative of web shell or backdoor execution. The rule specifically looks for web server processes (e.g., php.exe, w3wp.exe, httpd, nginx) as initiating processes, which then launch command interpreters (e.g., cmd.exe, powershell.exe, bash, python) with command lines containing obfuscation techniques like -EncodedCommand, FromBase64String, base64 -d, eval(), exec(), IEX, or Invoke-Expression.
Microsoft Sentinel (KQL)
