Suspicious PHP Command Execution

process where event.type == "start" and event.action == "exec" and process.parent.executable != null and
process.executable like ("/bin/php*", "/usr/bin/php*", "/usr/local/bin/php*") and
process.args == "-r" and process.command_line like~ (
  "*exec(*", "*system(*", "*shell_exec(*", "*passthru(*", "*proc_open(*", "*pcntl_exec(*", "*popen(*", 
  "*eval(*", "*assert(*", "*create_function(*", "*preg_replace(*e*", "*include(*", "*require(*",
  "*base64_decode(*", "*gzinflate(*", "*gzuncompress(*", "*str_rot13(*", "*urldecode(*", "*chr(*", 
  "*ord(*", "*strrev(*", "*strtr(*", "*pack(*", "*unpack(*", "*curl_exec(*", "*curl_multi_exec(*",
  "*file_get_contents(*", "*fopen(*", "*fsockopen(*", "*pfsockopen(*", "*stream_socket_client(*",
  "*socket_create(*", "*socket_connect(*", "*socket_write(*", "*socket_read(*", "*mail(*",
  "*move_uploaded_file(*"
) and not (
  // Exclude web server processes as these are covered by other rules
  process.working_directory like (
    "/var/www/*", "/builds/*", "/home/*/jenkins/*", "/home/*/public_html*", "/var/lib/ldap-account-manager/config",
    "/workspace/*", "/mnt/*", "/srv/www/*"
  ) or
  process.parent.args like (
    "/var/www/html/*", "source /home/*/.claude/shell*", "scripts/ci/render_build_configs.sh", "scripts/ci/build_package_vendor_cache.sh",
    "../source/scripts/ci/build_package_vendor_cache.sh", "/usr/local/bin/ncp-notify-update", "/usr/local/bin/ncp-notify-unattended-upgrade",
    "/usr/local/bin/ncp-check-nc-version", "/usr/local/bin/ncp-check-version"
  ) or
  process.args like "/usr/local/cpanel/*" or
  process.command_line like (
    "*https://composer.github.io/installer.sig*",
    "*json_decode(file_get_contents('php://stdin')*",
    "php -r exit(@fsockopen(getenv('DB_HOST')?:'postgres', (int)(getenv('DB_PORT')?:5432)) ? 0 : 1);",
    "php -r exit(@fsockopen(\"127.0.0.1\", 9501) ? 0 : 1);",
    "php -r echo urldecode(stream_get_contents(STDIN));",
    "*include(\"/var/www/nextcloud/config/config.php\")*"
  ) or
process.parent.command_line == "runc init" or
process.parent.executable in ("/opt/teleport/system/bin/teleport", "/usr/sbin/sshd") or
  (
    process.executable == "/usr/local/bin/php" and
    process.command_line == "php -r exit(@fsockopen('127.0.0.1', 9000) ? 0 : 1);"
  )
)