Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,246 detections
Filters
Last updated
All Time
Detection languages
3,321
1,086
505
478
471
Contributors
1,824
1,607
874
505
300
Categories
3,015
2,522
1,073
1,042
922
Platforms
39,921
7,246
6,535
3,864
3,627
Products / Services
1,331
1,102
991
658
494
MITRE Techniques
2,269
1,329
1,318
893
878
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects outbound IPv4 and IPv6 connections from endpoints to public addresses on ports other than DNS (53), HTTP (80), HTTPS (443), 8000.
Command-and-control tools and tunnels often use uncommon ports to avoid web-focused filtering. Private, loopback, link-local, multicast and documentation ranges are excluded, and repeated connections are grouped by endpoint, process, remote IP and port. Custom apps and admin tools also use these ports, so triage by process, destination reputation and how rare the destination is.
Command-and-control tools and tunnels often use uncommon ports to avoid web-focused filtering. Private, loopback, link-local, multicast and documentation ranges are excluded, and repeated connections are grouped by endpoint, process, remote IP and port. Custom apps and admin tools also use these ports, so triage by process, destination reputation and how rare the destination is.
The following analytic detects PHP command-line interpreters executing code supplied directly on the command line with the CLI -r / --run options, or code supplied to PHPDBG through standard input.
It covers common CLI executable names on Linux and Windows, including php.exe, php-win.exe, the legacy php-cli.exe name, versioned Linux php binaries, phpdbg, and FrankenPHP's php-cli subcommand.
PHP-CGI and PHP-FPM are excluded because they do not support the PHP CLI inline -r option.
This behavior can be used legitimately for administration and automation, but unexpected or obfuscated inline PHP execution may indicate an attacker using an installed interpreter to run commands without dropping a script file.
It covers common CLI executable names on Linux and Windows, including php.exe, php-win.exe, the legacy php-cli.exe name, versioned Linux php binaries, phpdbg, and FrankenPHP's php-cli subcommand.
PHP-CGI and PHP-FPM are excluded because they do not support the PHP CLI inline -r option.
This behavior can be used legitimately for administration and automation, but unexpected or obfuscated inline PHP execution may indicate an attacker using an installed interpreter to run commands without dropping a script file.
The following analytic detects instances where Java, or Tomcat processes spawn a Linux shell, which may indicate exploitation attempts, such as those related to CVE-2021-44228 (Log4Shell).
This detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process names and parent-child process relationships.
This activity is significant as it can signify a compromised Java application, potentially leading to unauthorized shell access.
If confirmed malicious, attackers could execute arbitrary commands, escalate privileges, or maintain persistent access, posing a severe threat to the environment.
This detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process names and parent-child process relationships.
This activity is significant as it can signify a compromised Java application, potentially leading to unauthorized shell access.
If confirmed malicious, attackers could execute arbitrary commands, escalate privileges, or maintain persistent access, posing a severe threat to the environment.
This analytic detects multipart POST requests containing a PHPSESSID form field and an uploaded filename with a PHP opening tag.
When observed with "PHP_SESSION_UPLOAD_PROGRESS" behavior, this may indicate an attempt to place executable PHP content into session-related data as part of PHP2Shell exploitation.
When observed with "PHP_SESSION_UPLOAD_PROGRESS" behavior, this may indicate an attempt to place executable PHP content into session-related data as part of PHP2Shell exploitation.
This analytic detects HTTP POST requests with a body of at least one megabyte that receive an HTTP 500 response.
Large failed uploads can indicate attempts to trigger resource exhaustion or exploit vulnerable request handling, including behavior associated with PHP2Shell, but require investigation with related web and application logs.
Large failed uploads can indicate attempts to trigger resource exhaustion or exploit vulnerable request handling, including behavior associated with PHP2Shell, but require investigation with related web and application logs.
This analytic correlates Apache and Nginx access and error logs when "multipart/form-data" requests and PHP memory-limit exhaustion errors occur for the same PID, host, and client.
It extracts web request details and "PHP" error messages to support investigation of possible PHP2Shell exploitation attempts.
It extracts web request details and "PHP" error messages to support investigation of possible PHP2Shell exploitation attempts.
This analytic detects multipart POST requests containing the "PHP_SESSION_UPLOAD_PROGRESS" form field and a serialized PHP structure in an uploaded filename.
This combination may indicate an attempt to exploit PHP session upload-progress handling and can be associated with PHP2Shell activity.
This combination may indicate an attempt to exploit PHP session upload-progress handling and can be associated with PHP2Shell activity.
Detects potential remote code execution, web shell activity, and post-exploitation behaviors originating from PHP worker processes on internet-facing hosts, referencing patterns associated with php2shell vulnerabilities. PHP-UP-2026
With a reported CVSS score of 9.2 and security updates scheduled for today, October 21, these vulnerabilities deserve attention, especially if you're still running legacy PHP versions.
šŖšµš¶š¹š² šš®š¶šš¶š»š“ š³š¼šæ ššµš² š¼š³š³š¶š°š¶š®š¹ š½š®šš°šµš²š š®š»š± šš²š°šµš»š¶š°š®š¹ š±š²šš®š¶š¹š, šš½š±š®šš² š®š¹š¹ š£šš£ š©š²šæšš¶š¼š»š šš¼ š®š š¹š²š®šš š“.š® šš¼ šÆš² š®šÆš¹š² šš¼ šµš®šš² ššµš² šš²š°ššæš¶šš šš½š±š®šš²š. I decided to spend some time exploring what we can already hunt for using Microsoft Defender XDR and KQL. I've put together a short technical article covering six hunting scenarios:
- PHP installations and outdated versions
- Suspicious child processes and command execution
- Reconnaissance activity
- Unexpected PHP file creation
- Unusual outbound network connections
- New process relationships compared to historical activity
These are not PHP2Shell-specific detections, but they can help identify suspicious activity on PHP servers without relying on published IoCs.
Sharing the queries in case they're useful for your own investigations.
šŖšµš¶š¹š² šš®š¶šš¶š»š“ š³š¼šæ ššµš² š¼š³š³š¶š°š¶š®š¹ š½š®šš°šµš²š š®š»š± šš²š°šµš»š¶š°š®š¹ š±š²šš®š¶š¹š, šš½š±š®šš² š®š¹š¹ š£šš£ š©š²šæšš¶š¼š»š šš¼ š®š š¹š²š®šš š“.š® šš¼ šÆš² š®šÆš¹š² šš¼ šµš®šš² ššµš² šš²š°ššæš¶šš šš½š±š®šš²š. I decided to spend some time exploring what we can already hunt for using Microsoft Defender XDR and KQL. I've put together a short technical article covering six hunting scenarios:
- PHP installations and outdated versions
- Suspicious child processes and command execution
- Reconnaissance activity
- Unexpected PHP file creation
- Unusual outbound network connections
- New process relationships compared to historical activity
These are not PHP2Shell-specific detections, but they can help identify suspicious activity on PHP servers without relying on published IoCs.
Sharing the queries in case they're useful for your own investigations.
Detects potential web server remote code execution through suspicious child processes launched by PHP, FastCGI, Apache, and IIS workers. Identifies reverse shells, encoded commands, payload retrieval, reconnaissance, and temporary PHP execution.
Detects and correlates installed PHP software packages and active PHP process execution across endpoints using device inventory, configuration data, and system logs to provide exposure visibility for PHP environments.
Identifies devices running PHP versions affected by CVE-2026-109618 or CVE-2026-109619. The detection returns affected hosts, operating system platform, installed PHP version, and associated IPv4 addresses to support vulnerability assessment and remediation.
Detects inbound exploitation sources and outbound callback destinations associated with PHP2Shell infrastructure (CVE-2026-109618), correlating both directions per device while filtering out standard browser traffic.
Detects web servers, PHP processes, or shell processes spawning fetch utilities such as wget or curl to communicate with a specific malicious payload IP address (162.35.99.94), often indicative of web shell exploitation or post-exploitation file download activity.
Identifies devices that have communicated with domains present in the OpenPhish public phishing feed by comparing domains observed in DeviceNetworkEvents.RemoteUrl against domains extracted from the current OpenPhish feed.
Detects post-exploitation behavior where a Node.js process spawns a shell, interpreter, or utility (such as sh, bash, nc, curl, python), which may indicate Remote Code Execution (RCE) via vulnerabilities like CVE-2026-111497 in the Node.js Brotli decoder.
Detects behavior where a Node.js process spawns a command shell or interpreter (such as sh, bash, cmd.exe, or powershell.exe) executing suspicious commands indicative of remote code execution (RCE), reverse shells, or payload downloading, consistent with vulnerabilities like the Node.js decompression flaw CVE-2026-111497.
Correlates PHP memory exhaustion or heap corruption error messages with subsequent Apache worker crashes (segfaults, aborts, bus errors) on the same host within a 5-minute window to detect potential exploitation attempts.
Detects abnormal PHP execution volume storms, process crashes handled by crash reporters (such as werfault.exe, apport, systemd-coredump), or application error events related to PHP, which may indicate denial of service attacks, exploitation attempts, or severe application instability.
Detects Node.js builds, Express, and body-parser libraries vulnerable to CVE-2026-111497 (Node2Shell) via Microsoft Defender vulnerability inventory, process telemetry, and software inventory.
Identifies Node.js processes that spawn potentially suspicious child processes, including operating system shells, command interpreters, scripting runtimes, and download utilities. This behaviour may indicate exploitation of a Node.js application resulting in arbitrary command execution, followed by payload retrieval or additional post-exploitation activity.
Page 1 of 346