// Illustrative hunt; not executed in a live Sentinel or Falcon tenant.
// Falcon Insight EDR / Advanced Event Search. REQUIRED time picker: last 1 hour.
// One sensor AID; requires ProcessRollup2 with parent name and command-line telemetry.
// Direct web-worker children only; baseline approved maintenance before alerting. Output at most 100 groups.
#event_simpleName=ProcessRollup2 aid="REPLACE_WITH_FALCON_AID"
| ParentBaseFileName=/^(w3wp|httpd|apache2|nginx|php-fpm[0-9.]*|tomcat[0-9]*)(\.exe)?$/i
| FileName=/^(cmd|powershell|pwsh|bash|sh|dash|curl|wget)(\.exe)?$/i
| groupBy([aid, ComputerName, ParentBaseFileName, FileName], function=[count(as=Executions), collect([CommandLine, ParentProcessId, TargetProcessId], limit=10)], limit=100)
| head(limit=100)