PHP2Shell source/callback IP sweep: inbound exploit and outbound callback
Detects inbound exploitation sources and outbound callback destinations associated with PHP2Shell infrastructure (CVE-2026-109618), correlating both directions per device while filtering out standard browser traffic.
Microsoft Sentinel (KQL)
