• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    PHP2Shell inbound exploitation and scanning source IP sweep

    avatar
    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    ills3c Intel&Coffee@Ills3C
    •updated 4 days ago•14•0•18

    Detects inbound network connections from known IP addresses associated with PHP2Shell exploitation attempts and malicious tooling infrastructure.

    Microsoft Sentinel (KQL)

    Tags

    Network ConnectionNetwork Connection InboundNetwork Connection AllowedWindowsLinuxWindows Defender Atpkql

    Found in

    • PHP2Shell Exploited to Deploy Potassium Mirai VariantLast updated 4 days ago

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?