REDCap help.php Web Shell Creation
Detects the creation or modification of a file named 'help.php' within directories associated with REDCap deployments. This activity is a known persistence mechanism used by threat actors like UNC6508 to establish web shell access.
Microsoft Sentinel (KQL)
