Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7 detections
Filters
Last updated
All Time
Detection languages
4
2
1
Contributors
2
1
1
1
1
Categories
3
2
1
1
1
Platforms
5
4
1
Products / Services
3
3
2
1
MITRE Techniques
3
2
1
1
1
CVEs
71
71
64
58
49
Detects potential remote code execution, web shell activity, and post-exploitation behaviors originating from PHP worker processes on internet-facing hosts, referencing patterns associated with php2shell vulnerabilities. PHP-UP-2026
Use this query if you don't have the Falcon Spotlight in your CrowdStrike subscription. Use this to identify any PHP running in your environment. We used this to quickly identify hosts running PHP.
With a reported CVSS score of 9.2 and security updates scheduled for today, October 21, these vulnerabilities deserve attention, especially if you're still running legacy PHP versions.
šŖšµš¶š¹š² šš®š¶šš¶š»š“ š³š¼šæ ššµš² š¼š³š³š¶š°š¶š®š¹ š½š®šš°šµš²š š®š»š± šš²š°šµš»š¶š°š®š¹ š±š²šš®š¶š¹š, šš½š±š®šš² š®š¹š¹ š£šš£ š©š²šæšš¶š¼š»š šš¼ š®š š¹š²š®šš š“.š® šš¼ šÆš² š®šÆš¹š² šš¼ šµš®šš² ššµš² šš²š°ššæš¶šš šš½š±š®šš²š. I decided to spend some time exploring what we can already hunt for using Microsoft Defender XDR and KQL. I've put together a short technical article covering six hunting scenarios:
- PHP installations and outdated versions
- Suspicious child processes and command execution
- Reconnaissance activity
- Unexpected PHP file creation
- Unusual outbound network connections
- New process relationships compared to historical activity
These are not PHP2Shell-specific detections, but they can help identify suspicious activity on PHP servers without relying on published IoCs.
Sharing the queries in case they're useful for your own investigations.
šŖšµš¶š¹š² šš®š¶šš¶š»š“ š³š¼šæ ššµš² š¼š³š³š¶š°š¶š®š¹ š½š®šš°šµš²š š®š»š± šš²š°šµš»š¶š°š®š¹ š±š²šš®š¶š¹š, šš½š±š®šš² š®š¹š¹ š£šš£ š©š²šæšš¶š¼š»š šš¼ š®š š¹š²š®šš š“.š® šš¼ šÆš² š®šÆš¹š² šš¼ šµš®šš² ššµš² šš²š°ššæš¶šš šš½š±š®šš²š. I decided to spend some time exploring what we can already hunt for using Microsoft Defender XDR and KQL. I've put together a short technical article covering six hunting scenarios:
- PHP installations and outdated versions
- Suspicious child processes and command execution
- Reconnaissance activity
- Unexpected PHP file creation
- Unusual outbound network connections
- New process relationships compared to historical activity
These are not PHP2Shell-specific detections, but they can help identify suspicious activity on PHP servers without relying on published IoCs.
Sharing the queries in case they're useful for your own investigations.
Detects and correlates installed PHP software packages and active PHP process execution across endpoints using device inventory, configuration data, and system logs to provide exposure visibility for PHP environments.
Inventory hunting query for the two critical PHP remote code execution vulnerabilities CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. PHP released the fixes on 21 October 2026 in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The query returns two kinds of rows. First, installed PHP packages in the Defender Vulnerability Management inventory whose version is below the fixed version of their branch or that belong to a branch the advisories do not cover (8.1 and older). Second, devices that Defender Vulnerability Management already associates with either CVE. Results show whether each device is internet facing and list those devices first. The query reads the Defender Vulnerability Management tables, so it runs in Defender XDR Advanced Hunting only. It lists installed versions and does not show which PHP build serves web requests or whether exploitation took place. Windows installs from zip archives are not inventoried and unusual package names are not matched. The second part can stay empty until Defender Vulnerability Management has processed the CVEs. The query follows the Microsoft Defender advanced hunting schemas and ran without errors in a live tenant.
Detects PHP error log entries indicating a session object decode failure, which may indicate exploitation attempts of CVE-2026-109618 and CVE-2026-109619. Note - the logsource product php / service error is not defined by SigmaHQ. Map it with a processing pipeline to wherever PHP error lines land in your stack (PHP error_log file, nginx or Apache error log, PHP-FPM log, or syslog/journal).
Detects PHP fatal out-of-memory errors reported in Unknown on line 0, indicating a memory exhaustion bailout before request initialization (pre-RINIT), associated with CVE-2026-109618 and CVE-2026-109619 exploitation attempts. Note - the logsource product php / service error is not defined by SigmaHQ. Map it with a processing pipeline to wherever PHP error lines land in your stack (PHP error_log file, nginx or Apache error log, PHP-FPM log, or syslog/journal). If log_errors is Off, or FPM runs with fastcgi.logging Off and catch_workers_output no, the line is never written.