Syed Usfar Wasim
@nCD24DeutschlandCompletionist
0 followers15 downloads736 copies14 likes1,338 views
45 detections
Filters
Last updated
All Time
Detection languages
45
Categories
4
2
2
2
2
Platforms
18
8
3
2
2
Products / Services
4
3
3
1
1
MITRE Techniques
8
7
7
6
6
CVEs
3
3
1
1
1
IDS Classtypes
2
1
KQL detects suspicious child processes launched by PHP or web-server workers following possible exploitation of CVE-2026-109618 or CVE-2026-109619.
Identifies Microsoft Defender Vulnerability Management software inventory to identify endpoints running PHP versions potentially affected by CVE-2026-109618 and CVE-2026-109619
KQL Query from file: High-Fidelity php2shell KQL Detection
PA Threat Prevention for potential exploitation of PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619.
Detects Akamai SIEM logs for PHP2Shell exploitation attempts associated with CVE-2026-109618 and CVE-2026-109619
Detects Check Point SmartDefense logs for network detections associated with PHP2Shell, specifically CVE-2026-109618 and CVE-2026-109619
Detects ADNotificationManager.exe (Adobe Notification Manager) running from an unusual or unknown directory, which may be indicative of DLL Side-Loading. This binary has been observed being abused by multiple threat actors including GOLD BLADE to sideload malicious DLLs and deliver C2 payloads such as Havoc.
This KQL detects potential social engineering and vishing activity in Microsoft Teams over the last 30 days.
This KQL inventories activity associated with a specified root domain and its subdomains across DeviceNetworkEvents, EmailUrlInfo, CloudAppEvents.
Detects potential abuse of Microsoft Defender’s BTR boot-time remediation driver by correlating known driver loads with BootClean.log activity, unexpected loader processes, and driver execution outside normal Defender paths.
Page 1 of 5