✄𐘗
text code block:
✄𐘗file where host.os.type == "linux" and event.action != "deletion" and
(
  process.name in (
    "nginx", "apache2", "httpd", "caddy", "lighttpd", "httpd.worker", "httpd-worker", "httpd-prefork",
    "php-cgi", "php-fcgi", "php-cgi.cagefs", "frankenphp", "lshttpd", "litespeed", "openlitespeed",
    "fcgiwrap", "uwsgi", "daphne", "uvicorn", "hypercorn", "granian", "waitress-serve", "flask", "puma",
    "unicorn", "unicorn_rails", "thin", "rackup", "mongrel_rails", "starman", "plackup", "twiggy",
    "hypnotoad", "starlet", "unitd", "unitd-debug", "java", "node", "nodejs"
  ) or
  process.name like (
    "php-fpm*", "lsphp*", "gunicorn*", "*.cgi", "*.fcgi", "mono*", "xsp*", "mod-mono-server*",
    "fastcgi-mono-server*", "python*", "ruby*", "perl*", "lua*"
  )
) and
file.extension in~ ( 
  "php", "phtml", "pht", "php3", "php4", "php5", "php7", "phar",
  "asp", "aspx", "ashx", "asmx", "ascx", "cshtml",
  "jsp", "jspx", "jsx", "jspf", "tag", "tagx", "war", "ear",
  "js", "mjs", "cjs", "ts", "mts", "cts", "tsx",
  "razor",
  "py", "wsgi", "cgi", "fcgi", "pyc",
  "erb", "ru",
  "psgi",
  "lua", "luac",
  "sh", "elf"
) and
file.Ext.header_bytes like (
  "ffd8ff*",                // JPEG / JPG
  "89504e470d0a1a0a*",      // PNG 
  "47494638*",              // GIF (GIF87a / GIF89a)
  "00000100*",              // ICO
  "00000200*",              // CUR
  "424d*",                  // BMP
  "49492a00*",              // TIFF (little endian)
  "4d4d002a*",              // TIFF (big endian)
  "52494646*",              // RIFF container (WEBP/AVI/etc)
  "255044462d*",            // PDF
  "7f454c46*"               // ELF
)