✄𐘗
text code block:
✄𐘗file where host.os.type == "linux" and event.action != "deletion" and
(
  process.name in (
    "nginx", "apache2", "httpd", "caddy", "lighttpd", "httpd.worker", "httpd-worker", "httpd-prefork",
    "php-cgi", "php-fcgi", "php-cgi.cagefs", "frankenphp", "lshttpd", "litespeed", "openlitespeed",
    "fcgiwrap", "uwsgi", "daphne", "uvicorn", "hypercorn", "granian", "waitress-serve", "flask", "puma",
    "unicorn", "unicorn_rails", "thin", "rackup", "mongrel_rails", "starman", "plackup", "twiggy",
    "hypnotoad", "starlet", "unitd", "unitd-debug", "java", "node", "nodejs", "varnishd"
  ) or
  process.name like (
    "php-fpm*", "lsphp*", "gunicorn*", "*.cgi", "*.fcgi", "mono*", "xsp*", "mod-mono-server*",
    "fastcgi-mono-server*", "python*", "ruby*", "perl*", "lua*"
  )
) and
file.name like~ (
  "*.php.*", "*.php3.*", "*.php4.*", "*.php5.*", "*.php7.*", "*.php8.*", "*.phtml.*", "*.pht.*",
  "*.asp.*", "*.aspx.*", "*.ashx.*", "*.asmx.*", "*.jsp.*", "*.jspx.*", "*.cfm.*", "*.cfc.*",
  "*.cshtml.*", "*.razor.*", "*.cgi.*", "*.fcgi.*", "*.php;*", "*.asp;*", "*.aspx;*", "*.jsp;*"
) and
file.extension in~ (
  "jpg", "jpeg", "png", "gif", "webp", "bmp", "ico", "tif", "tiff", "svg", "zip",
  "sh", "elf"
)