Watching PHP with process-watcher: quick start https://infosec.pub/post/53881612 [https://infosec.pub/u/digicat] #blueteamsec