sequence by agent.id with maxspan=5m
  [network where
   data_stream.dataset == "network_traffic.http" and
   http.request.method in ("POST", "PUT") and
   /* We can restrict to 200 in the future, but I prefer to broaden the scope and decrease it later if necessary */
   http.response.status_code in (200, 201, 204, 301, 302, 303, 409) and
   /* These should detect most common file upload activities, adhering to browser standards */
   http.request.body.content like "*Content-Disposition: form-data*" and
   http.request.body.content like "*filename=*"
   /* May add a lower/upper boundary limit to reduce FPs in the future, e.g.
   and http.request.body.bytes >= 500
   */
  ]
  [file where
   event.dataset == "endpoint.events.file" and
   event.action in ("creation", "rename") and
   file.extension in ("php", "phtml", "pht", "php5", "asp", "aspx", "jsp", "jspx", "war", "cgi")
   /* We can add file.path values here in the future, if telemetry is noisy */
  ]
  [network where
   data_stream.dataset == "network_traffic.http" and
   http.request.method in ("GET", "POST") and
   /* we may restrict to 200, but keeping it broader right now */
   http.response.status_code >= 200 and http.response.status_code < 600 and
   url.extension in ("php", "phtml", "pht", "php5", "asp", "aspx", "jsp", "jspx", "war", "cgi")
  ]