php2shell in the Lab, and Where a SOC Catches It

We built a working php2shell exploit on Linux in a lab, tested our detections against it (and the Windows pattern with a simulated command), and wrote two rules from what we found.