Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
564 detections
Filters
Last updated
All Time
Detection languages
252
126
45
35
32
Contributors
124
91
63
58
25
Categories
237
209
176
134
114
Platforms
372
252
56
8
7
Products / Services
258
135
112
101
60
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
15
14
14
10
9
IDS Classtypes
30
5
IDS Protocols
35
KQL detects suspicious child processes launched by PHP or web-server workers following possible exploitation of CVE-2026-109618 or CVE-2026-109619.
Detects potential remote code execution, web shell activity, and post-exploitation behaviors originating from PHP worker processes on internet-facing hosts, referencing patterns associated with php2shell vulnerabilities. PHP-UP-2026
Identifies Microsoft Defender Vulnerability Management software inventory to identify endpoints running PHP versions potentially affected by CVE-2026-109618 and CVE-2026-109619
Detects web server worker processes (php-fpm, apache2, httpd, nginx) or PHP interpreters spawning shell or reconnaissance utilities (sh, bash, curl, wget, id, whoami), consistent with post-exploitation activity such as PHP2Shell remote code execution.
Detects web requests associated with PHP2Shell exploitation attempts: probing for randomized shell_<8 hex> files in common upload directories (.php, .phtml, .php5, .phar) and PoC marker strings in the query string. In the observed campaign these probes returned 404,but a 200 response on a matching path should be treated as a confirmed webshell.
Detects a PHP interpreter or PHP worker process (php-fpm, php-cgi, Apache httpd/apache2, or nginx workers) writing a new PHP-related script file into web root, upload, or temp directories. This is indicative of a webshell drop pattern following an unauthenticated remote code execution vulnerability.
Detects suspicious post-exploitation activities, reconnaissance, and command execution originating from web server and PHP lineage processes, indicating potential webshell activity or compromised web applications.
The following analytic identifies the execution of suspicious processes typically associated with WebShell activity on web servers.
It detects when processes like `cmd.exe`, `powershell.exe`, or `bash.exe` are spawned by web server processes such as `w3wp.exe` or `nginx.exe`.
This behavior is significant as it may indicate an adversary exploiting a web application vulnerability to install a WebShell, providing persistent access and command execution capabilities.
If confirmed malicious, this activity could allow attackers to maintain control over the compromised server, execute arbitrary commands, and potentially escalate privileges or exfiltrate sensitive data.
It detects when processes like `cmd.exe`, `powershell.exe`, or `bash.exe` are spawned by web server processes such as `w3wp.exe` or `nginx.exe`.
This behavior is significant as it may indicate an adversary exploiting a web application vulnerability to install a WebShell, providing persistent access and command execution capabilities.
If confirmed malicious, this activity could allow attackers to maintain control over the compromised server, execute arbitrary commands, and potentially escalate privileges or exfiltrate sensitive data.
Detects suspicious post-exploitation activities, reconnaissance, and command execution originating from web server and PHP lineage processes, indicating potential webshell activity or compromised web applications.
Detects PHP SAPI processes accessing /proc/self/mem (or equivalent memory mapping) and subsequently spawning a Unix shell, which is characteristic of web shell activity or exploitation of PHP memory corruption/injection vulnerabilities like zif_system.
Detects a sequence where an Apache HTTP server spawns a shell (sh, bash, dash) followed within a 6-hour window by network connections to internal ports (LDAP, SMB, Kerberos) from the same device, indicative of web shell activity and potential internal reconnaissance or relay attempts.
Detects web server worker processes (such as PHP-FPM, Apache httpd, etc.) launching shells, interpreters, or download/network tools, which is a common post-exploitation pattern following remote code execution (RCE) vulnerabilities.
Detects web server or PHP worker processes (such as php-fpm, httpd, or w3wp.exe) creating, modifying, or renaming .php files within common web root directories, which is a common indicator of web shell deployment or webshell activity.
Detects Check Point SmartDefense logs for network detections associated with PHP2Shell, specifically CVE-2026-109618 and CVE-2026-109619
Detects post-exploitation activity targeting PaperCut servers, including shells spawned by the PaperCut Java process or the creation of malicious files (such as .class files in lib/ or .txt webshells in custom/web/) by the Java application.
Detects suspicious post-exploitation activities, reconnaissance, and command execution originating from web server and PHP lineage processes, indicating potential webshell activity or compromised web applications.
Detects files written under Magento pub/media/custom_options/quote by a web server or PHP process, and flags when a subsequent process command line references the uploaded file, indicating potential web shell activity.
Detects the execution of reverse shell commands, interpreters, or utilities (such as Netcat, Python, or bash using /dev/tcp) spawned from web server worker processes or script interpreters, which is typically indicative of a web shell or remote code execution exploitation.
Detects post-compromise persistence activity following PHP Remote Code Execution (RCE), where web server or PHP worker processes spawn commands to create accounts, set up cron jobs, configure scheduled tasks, or write PHP web shell files directly into web server document roots.
Detects a PHP FastCGI worker (such as php-cgi, php-fpm) spawning a PHP one-liner or shell interpreter executing code that writes, executes, and deletes a temporary PHP file. This pattern is characteristic of web shells or remote code execution exploitation.
Detects PHP or web server worker processes spawning network or transfer utilities such as curl, wget, nc, or certutil, which is indicative of post-exploitation activity like web shell command execution.
Page 1 of 27