Both campaigns end in web-server-spawned shells and miners. Look for the web service process spawning cmd/powershell/sh, new script files in web roots, and outbound connections to mining pools.

// KQL (Defender) sketch
DeviceProcessEvents
| where InitiatingProcessFileName in~ ("java.exe","w3wp.exe","httpd","php-fpm")
| where FileName in~ ("cmd.exe","powershell.exe","sh","bash")
| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLine

Tune the parent list to your stack. Sketch only; validate before alerting.