Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,670 detections
Filters
Last updated
All Time
Detection languages
10,186
119
110
99
60
Contributors
2,820
2,800
1,768
504
492
Categories
4,280
2,976
2,237
1,829
1,457
Platforms
10,381
1,107
807
155
98
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
3,812
3,129
1,796
1,571
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
Detects Node.js processes spawning shells, script hosts or download tools, which is how post exploitation of a Node.js server would look after CVE-2026-111497 (Brotli decoder out of bounds write, fixed in 22.23.4, 24.22.1 and 26.12.1). Devices that Defender Vulnerability Management lists as vulnerable are flagged and sorted first, and rows are still returned when the CVE is not listed. It excludes npm, npx, yarn and pnpm processes and GitHub Actions runner action processes, which start shells for build scripts. It does not detect the memory corruption itself. The query ran without errors in a live tenant.
Detects potential DLL sideloading where the legitimate Avira antivirus binary (avscan.exe) loads a custom DLL (avscan.dll) from user-writable directories such as AppData, Public, or ProgramData, potentially accompanied by a configuration file.
Detects a VS Code-family editor or extension host process running 'git config --global user.email' and, within one minute from the same parent process, a curl public-IP lookup (ifconfig.me / api.ipify.org), the host-profiling step of the trojanized anthropic.claude-code loader.
Detects potential remote code execution, web shell activity, and post-exploitation behaviors originating from PHP worker processes on internet-facing hosts, referencing patterns associated with php2shell vulnerabilities. PHP-UP-2026
With a reported CVSS score of 9.2 and security updates scheduled for today, October 21, these vulnerabilities deserve attention, especially if you're still running legacy PHP versions.
šŖšµš¶š¹š² šš®š¶šš¶š»š“ š³š¼šæ ššµš² š¼š³š³š¶š°š¶š®š¹ š½š®šš°šµš²š š®š»š± šš²š°šµš»š¶š°š®š¹ š±š²šš®š¶š¹š, šš½š±š®šš² š®š¹š¹ š£šš£ š©š²šæšš¶š¼š»š šš¼ š®š š¹š²š®šš š“.š® šš¼ šÆš² š®šÆš¹š² šš¼ šµš®šš² ššµš² šš²š°ššæš¶šš šš½š±š®šš²š. I decided to spend some time exploring what we can already hunt for using Microsoft Defender XDR and KQL. I've put together a short technical article covering six hunting scenarios:
- PHP installations and outdated versions
- Suspicious child processes and command execution
- Reconnaissance activity
- Unexpected PHP file creation
- Unusual outbound network connections
- New process relationships compared to historical activity
These are not PHP2Shell-specific detections, but they can help identify suspicious activity on PHP servers without relying on published IoCs.
Sharing the queries in case they're useful for your own investigations.
šŖšµš¶š¹š² šš®š¶šš¶š»š“ š³š¼šæ ššµš² š¼š³š³š¶š°š¶š®š¹ š½š®šš°šµš²š š®š»š± šš²š°šµš»š¶š°š®š¹ š±š²šš®š¶š¹š, šš½š±š®šš² š®š¹š¹ š£šš£ š©š²šæšš¶š¼š»š šš¼ š®š š¹š²š®šš š“.š® šš¼ šÆš² š®šÆš¹š² šš¼ šµš®šš² ššµš² šš²š°ššæš¶šš šš½š±š®šš²š. I decided to spend some time exploring what we can already hunt for using Microsoft Defender XDR and KQL. I've put together a short technical article covering six hunting scenarios:
- PHP installations and outdated versions
- Suspicious child processes and command execution
- Reconnaissance activity
- Unexpected PHP file creation
- Unusual outbound network connections
- New process relationships compared to historical activity
These are not PHP2Shell-specific detections, but they can help identify suspicious activity on PHP servers without relying on published IoCs.
Sharing the queries in case they're useful for your own investigations.
Detects the execution of unauthorized Remote Monitoring and Management (RMM) tools shortly after either Microsoft Teams activity or a surge of inbound emails (email bombing) targeting the same user, a common precursor pattern used by threat actors for social engineering and initial access.
Detects PHP exposure to CVE-2026-109618 and CVE-2026-109619 (PHP2Shell): installed packages below the fixed versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12 or on branches the advisories do not cover, devices that Defender Vulnerability Management flags for either CVE, and PHP processes that ran in the last 30 days on devices with no PHP package in the inventory. Every row carries the live CISA KEV status of both CVEs and internet facing devices are listed first. A last row shows the KEV feed row count and newest entry date, so an empty result can be told apart from an empty or outdated feed. It does not show whether exploitation took place and appliances that embed PHP need their vendor advisories. The query ran without errors in a live tenant.
Detects inbound exploitation sources and outbound callback destinations associated with PHP2Shell infrastructure (CVE-2026-109618), correlating both directions per device while filtering out standard browser traffic.
Inventory hunting query for the two critical PHP remote code execution vulnerabilities CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. PHP released the fixes on 21 October 2026 in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The query returns two kinds of rows. First, installed PHP packages in the Defender Vulnerability Management inventory whose version is below the fixed version of their branch or that belong to a branch the advisories do not cover (8.1 and older). Second, devices that Defender Vulnerability Management already associates with either CVE. Results show whether each device is internet facing and list those devices first. The query reads the Defender Vulnerability Management tables, so it runs in Defender XDR Advanced Hunting only. It lists installed versions and does not show which PHP build serves web requests or whether exploitation took place. Windows installs from zip archives are not inventoried and unusual package names are not matched. The second part can stay empty until Defender Vulnerability Management has processed the CVEs. The query follows the Microsoft Defender advanced hunting schemas and ran without errors in a live tenant.
Detects creation, modification, disabling, or deletion of Windows Firewall rules and profiles using netsh.exe or PowerShell NetSecurity cmdlets. Adversaries tamper with the host firewall to disable defenses, open inbound or outbound paths for tools and C2, or remove blocking rules. This is common in hands-on-keyboard intrusions and ransomware staging. The query matches on file name and original file name to catch renamed binaries, covers both modern (advfirewall) and legacy (netsh firewall) syntax, and labels each event with the action performed to speed up triage.
Detects the installation or execution of unauthorized Remote Monitoring and Management (RMM) tools such as MeshCentral, Atera, Teramind, AnyDesk, or AdaptixC2 artifacts on endpoints. It flags devices running multiple distinct RMM tools or featuring AdaptixC2.
Hunts DeviceFileCertificateInfo for files signed by certificates issued by the eight eMudhra (and eight Sectigo) intermediate CAs with compromised weak keys. It matches on issuer hash, issuer name and CA serial, with an optional broader eMudhra/emSign match.
Detects the Tensorlake npm compromise (tensorlake@0.5.144, Shai-Hulud) through the two payload hashes, gh-token-monitor persistence, node or bun running lib/setup.mjs or Math_Symbol.js and node or bun connections to iseekaigogo.com or public Ethereum RPC hosts. It needs Defender for Endpoint events from developer machines and does not see lockfile or package cache contents. The query ran without errors in a live tenant
Detects suspicious post-exploitation activities, reconnaissance, and command execution originating from web server and PHP lineage processes, indicating potential webshell activity or compromised web applications.
Detects processes rapidly invoking multiple system and network reconnaissance APIs (such as NetGetJoinInformation, NetSessionEnum, GetAdaptersAddresses, etc.) within a short window, which is indicative of automated discovery or reconnaissance activity.
Correlates devices touched by known IoC IP scan waves with PHP software inventory, vulnerability management data for PHP CVEs, and active PHP process execution telemetry to identify vulnerable exposed web servers.
Detects execution of Mimikatz or LSASS process memory credential theft techniques that are preceded by common discovery tools (such as nltest, net, adcmd, netexec, or kerbrute) on the same device within a 24-hour window.
Detects web server worker processes or PHP interpreters spawning suspicious child processes associated with reverse shells, network sockets, or reconnaissance commands.
Detects instances where Microsoft Teams (ms-teams.exe, Teams.exe) or its associated WebView2 process spawns a command or script interpreter (such as PowerShell, Cmd, Mshta, Wscript, Cscript) with suspicious download-and-execute arguments, which is commonly associated with ClickFix social engineering attacks or similar initial access tactics.
Detects the Inisafe CrossWeb EX service (INISAFECrossWebEXSvc.exe) launching fsquirt.exe, which can indicate potential abuse of built-in Windows utilities following a malicious lure or script execution.
Detects reconnaissance commands (whoami, systeminfo) and PowerShell execution spawned as children of remote-access tools (such as AnyDesk, ScreenConnect, TeamViewer/QuickAssist variants, etc.), followed shortly by an outbound network connection to a .top domain from the same device.
Page 1 of 509