Literal SHA256 IOC sweep for Huntress php2shell advisory body hash
Detects the presence of a specific malicious SHA256 file hash across device file events, process execution events, and image load events over a 30-day window using Microsoft Defender for Endpoint data.
Microsoft Sentinel (KQL)
