MS Sentinel Query of the day:

DeviceTvmSoftwareInventory
| where SoftwareVendor == @"php"

#php2shell