Detect Server Software Component in Microsoft Sentinel

let WebServerProcesses = dynamic(["w3wp.exe","httpd.exe","nginx.exe","tomcat9.exe","tomcat.exe","java.exe","php-cgi.exe","perl.exe","python.exe","ruby.exe","node.exe","gunicorn","uvicorn"]);
let SuspiciousChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","certutil.exe","bitsadmin.exe","net.exe","net1.exe","whoami.exe","hostname.exe","ipconfig.exe","systeminfo.exe","nltest.exe","arp.exe","curl.exe","wget.exe","ping.exe","tracert.exe","nslookup.exe","sc.exe"]);
let WebRootPaths = dynamic(["\\inetpub\\","\\wwwroot\\","\\htdocs\\","\\webapps\\","\\public_html\\","\\web\\content\\","/var/www/","/srv/www/","/usr/share/nginx/"]);
let WebShellExtensions = dynamic([".aspx",".asp",".php",".jsp",".jspx",".cfm",".shtml",".ashx",".asmx",".phtml"]);
// Signal 1: Web server process spawning command interpreters or OS recon tools (primary web shell execution indicator)
let WebShellExecution = DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName has_any (WebServerProcesses)
| where FileName has_any (SuspiciousChildren)
| extend DetectionType = "WebShell_ChildProcess"
| extend RiskLevel = case(
    FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe"), "Critical",
    FileName in~ ("rundll32.exe","regsvr32.exe","certutil.exe","bitsadmin.exe"), "High",
    "Medium"
  )
| project Timestamp, DeviceName, AccountName, DetectedFileName=FileName, ProcessCommandLine,
         ParentProcess=InitiatingProcessFileName, ParentCommandLine=InitiatingProcessCommandLine,
         FolderPath, DetectionType, RiskLevel;
// Signal 2: Suspicious script files written to web-accessible directories by non-deployment processes
let WebFileCreation = DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in~ ("FileCreated","FileModified")
| where FolderPath has_any (WebRootPaths)
| where FileName has_any (WebShellExtensions)
| where InitiatingProcessFileName !in~ ("msiexec.exe","setup.exe","install.exe","devenv.exe","code.exe","explorer.exe","robocopy.exe","xcopy.exe","w3wp.exe")
| extend DetectionType = "SuspiciousWebFile_Written"
| extend RiskLevel = "High"
| project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName,
         DetectedFileName=FileName, ProcessCommandLine=InitiatingProcessCommandLine,
         ParentProcess=InitiatingProcessFileName, ParentCommandLine=InitiatingProcessCommandLine,
         FolderPath, DetectionType, RiskLevel;
// Signal 3: Unauthorized IIS native module or ISAPI filter DLL registration via registry
let IISModuleRegistration = DeviceRegistryEvents
| where Timestamp > ago(24h)
| where ActionType in~ ("RegistryValueSet","RegistryKeyCreated")
| where RegistryKey has "SYSTEM\\CurrentControlSet\\Services\\W3SVC"
    or RegistryKey has "SOFTWARE\\Microsoft\\InetStp"
    or RegistryKey has "SYSTEM\\CurrentControlSet\\Services\\WAS"
| where RegistryValueData has ".dll"
| where InitiatingProcessFileName !in~ ("msiexec.exe","TrustedInstaller.exe","wusa.exe")
| extend DetectionType = "IIS_Module_Registered"
| extend RiskLevel = "High"
| project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName,
         DetectedFileName=InitiatingProcessFileName, ProcessCommandLine=InitiatingProcessCommandLine,
         ParentProcess=InitiatingProcessParentFileName, ParentCommandLine=InitiatingProcessCommandLine,
         FolderPath=RegistryKey, DetectionType, RiskLevel;
// Combine all signals
union WebShellExecution, WebFileCreation, IISModuleRegistration
| sort by Timestamp desc