Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,270 detections
Filters
Last updated
All Time
Detection languages
3,342
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,031
2,542
1,076
1,049
929
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
1,331
1,109
991
658
494
MITRE Techniques
2,271
1,336
1,318
904
885
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects outbound IPv4 and IPv6 connections from endpoints to public addresses on ports other than DNS (53), HTTP (80), HTTPS (443), 8000.
Command-and-control tools and tunnels often use uncommon ports to avoid web-focused filtering. Private, loopback, link-local, multicast and documentation ranges are excluded, and repeated connections are grouped by endpoint, process, remote IP and port. Custom apps and admin tools also use these ports, so triage by process, destination reputation and how rare the destination is.
Command-and-control tools and tunnels often use uncommon ports to avoid web-focused filtering. Private, loopback, link-local, multicast and documentation ranges are excluded, and repeated connections are grouped by endpoint, process, remote IP and port. Custom apps and admin tools also use these ports, so triage by process, destination reputation and how rare the destination is.
Sweeps endpoint telemetry for known IOCs from the trojanized anthropic.claude-code (Open-VSX v2.1.313) SSH backdoor: C2 IP 134.209.82.225, beacon URL, extension.js and tunnel key SHA-256 hashes, and ifconfig.me lookups from VS Code-family/extension-host processes. Results are summarized per device and IOC.
The following analytic detects PHP command-line interpreters executing code supplied directly on the command line with the CLI -r / --run options, or code supplied to PHPDBG through standard input.
It covers common CLI executable names on Linux and Windows, including php.exe, php-win.exe, the legacy php-cli.exe name, versioned Linux php binaries, phpdbg, and FrankenPHP's php-cli subcommand.
PHP-CGI and PHP-FPM are excluded because they do not support the PHP CLI inline -r option.
This behavior can be used legitimately for administration and automation, but unexpected or obfuscated inline PHP execution may indicate an attacker using an installed interpreter to run commands without dropping a script file.
It covers common CLI executable names on Linux and Windows, including php.exe, php-win.exe, the legacy php-cli.exe name, versioned Linux php binaries, phpdbg, and FrankenPHP's php-cli subcommand.
PHP-CGI and PHP-FPM are excluded because they do not support the PHP CLI inline -r option.
This behavior can be used legitimately for administration and automation, but unexpected or obfuscated inline PHP execution may indicate an attacker using an installed interpreter to run commands without dropping a script file.
The following analytic detects instances where Java, or Tomcat processes spawn a Linux shell, which may indicate exploitation attempts, such as those related to CVE-2021-44228 (Log4Shell).
This detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process names and parent-child process relationships.
This activity is significant as it can signify a compromised Java application, potentially leading to unauthorized shell access.
If confirmed malicious, attackers could execute arbitrary commands, escalate privileges, or maintain persistent access, posing a severe threat to the environment.
This detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process names and parent-child process relationships.
This activity is significant as it can signify a compromised Java application, potentially leading to unauthorized shell access.
If confirmed malicious, attackers could execute arbitrary commands, escalate privileges, or maintain persistent access, posing a severe threat to the environment.
This analytic detects multipart POST requests containing a PHPSESSID form field and an uploaded filename with a PHP opening tag.
When observed with "PHP_SESSION_UPLOAD_PROGRESS" behavior, this may indicate an attempt to place executable PHP content into session-related data as part of PHP2Shell exploitation.
When observed with "PHP_SESSION_UPLOAD_PROGRESS" behavior, this may indicate an attempt to place executable PHP content into session-related data as part of PHP2Shell exploitation.
This analytic correlates Apache and Nginx access and error logs when "multipart/form-data" requests and PHP memory-limit exhaustion errors occur for the same PID, host, and client.
It extracts web request details and "PHP" error messages to support investigation of possible PHP2Shell exploitation attempts.
It extracts web request details and "PHP" error messages to support investigation of possible PHP2Shell exploitation attempts.
This analytic detects HTTP POST requests with a body of at least one megabyte that receive an HTTP 500 response.
Large failed uploads can indicate attempts to trigger resource exhaustion or exploit vulnerable request handling, including behavior associated with PHP2Shell, but require investigation with related web and application logs.
Large failed uploads can indicate attempts to trigger resource exhaustion or exploit vulnerable request handling, including behavior associated with PHP2Shell, but require investigation with related web and application logs.
Detects a VS Code-family editor or extension host process running 'git config --global user.email' and, within one minute from the same parent process, a curl public-IP lookup (ifconfig.me / api.ipify.org), the host-profiling step of the trojanized anthropic.claude-code loader.
Detects the presence of the compromised anthropic.claude-code VS Code extension version 2.1.313 or its associated bad hash on disk, reverse SSH tunneling spawned by code editors or extension hosts, and network connections to known malicious C2 IP address 134.209.82.225.
Detects a VS Code-family editor or extension host modifying ~/.ssh/authorized_keys, or shell commands appending the svc-telemetry label / embedded Ed25519 key, as used by the trojanized anthropic.claude-code extension.
Detects indicators of compromise associated with a trojanized Claude Code VS Code extension distributed through Cursor's marketplace. The rule identifies file modifications to authorized_keys, process executions establishing reverse SSH tunnels, specific hardcoded C2 IP addresses, and references to the attacker's SSH key 'svc-telemetry'.
This analytic detects multipart POST requests containing the "PHP_SESSION_UPLOAD_PROGRESS" form field and a serialized PHP structure in an uploaded filename.
This combination may indicate an attempt to exploit PHP session upload-progress handling and can be associated with PHP2Shell activity.
This combination may indicate an attempt to exploit PHP session upload-progress handling and can be associated with PHP2Shell activity.
Detects potential remote code execution, web shell activity, and post-exploitation behaviors originating from PHP worker processes on internet-facing hosts, referencing patterns associated with php2shell vulnerabilities. PHP-UP-2026
With a reported CVSS score of 9.2 and security updates scheduled for today, October 21, these vulnerabilities deserve attention, especially if you're still running legacy PHP versions.
šŖšµš¶š¹š² šš®š¶šš¶š»š“ š³š¼šæ ššµš² š¼š³š³š¶š°š¶š®š¹ š½š®šš°šµš²š š®š»š± šš²š°šµš»š¶š°š®š¹ š±š²šš®š¶š¹š, šš½š±š®šš² š®š¹š¹ š£šš£ š©š²šæšš¶š¼š»š šš¼ š®š š¹š²š®šš š“.š® šš¼ šÆš² š®šÆš¹š² šš¼ šµš®šš² ššµš² šš²š°ššæš¶šš šš½š±š®šš²š. I decided to spend some time exploring what we can already hunt for using Microsoft Defender XDR and KQL. I've put together a short technical article covering six hunting scenarios:
- PHP installations and outdated versions
- Suspicious child processes and command execution
- Reconnaissance activity
- Unexpected PHP file creation
- Unusual outbound network connections
- New process relationships compared to historical activity
These are not PHP2Shell-specific detections, but they can help identify suspicious activity on PHP servers without relying on published IoCs.
Sharing the queries in case they're useful for your own investigations.
šŖšµš¶š¹š² šš®š¶šš¶š»š“ š³š¼šæ ššµš² š¼š³š³š¶š°š¶š®š¹ š½š®šš°šµš²š š®š»š± šš²š°šµš»š¶š°š®š¹ š±š²šš®š¶š¹š, šš½š±š®šš² š®š¹š¹ š£šš£ š©š²šæšš¶š¼š»š šš¼ š®š š¹š²š®šš š“.š® šš¼ šÆš² š®šÆš¹š² šš¼ šµš®šš² ššµš² šš²š°ššæš¶šš šš½š±š®šš²š. I decided to spend some time exploring what we can already hunt for using Microsoft Defender XDR and KQL. I've put together a short technical article covering six hunting scenarios:
- PHP installations and outdated versions
- Suspicious child processes and command execution
- Reconnaissance activity
- Unexpected PHP file creation
- Unusual outbound network connections
- New process relationships compared to historical activity
These are not PHP2Shell-specific detections, but they can help identify suspicious activity on PHP servers without relying on published IoCs.
Sharing the queries in case they're useful for your own investigations.
Detects potential web server remote code execution through suspicious child processes launched by PHP, FastCGI, Apache, and IIS workers. Identifies reverse shells, encoded commands, payload retrieval, reconnaissance, and temporary PHP execution.
Detects and correlates installed PHP software packages and active PHP process execution across endpoints using device inventory, configuration data, and system logs to provide exposure visibility for PHP environments.
Identifies devices running PHP versions affected by CVE-2026-109618 or CVE-2026-109619. The detection returns affected hosts, operating system platform, installed PHP version, and associated IPv4 addresses to support vulnerability assessment and remediation.
Detects when a web server account (such as www-data, apache, nginx) spawns a shell (bash, sh, etc.), 'su', or 'unshare', which may indicate web application exploitation and post-compromise activity. The query ran without errors in a live tenant.
Detects inbound exploitation sources and outbound callback destinations associated with PHP2Shell infrastructure (CVE-2026-109618), correlating both directions per device while filtering out standard browser traffic.
Identifies devices that have communicated with domains present in the OpenPhish public phishing feed by comparing domains observed in DeviceNetworkEvents.RemoteUrl against domains extracted from the current OpenPhish feed.
Detects web servers, PHP processes, or shell processes spawning fetch utilities such as wget or curl to communicate with a specific malicious payload IP address (162.35.99.94), often indicative of web shell exploitation or post-exploitation file download activity.
Page 1 of 347