Suraj A
@cytechCompletionist
0 followers115 downloads364 copies2 likes1,128 views
90 detections
Filters
Last updated
All Time
Detection languages
72
18
Categories
52
42
15
11
11
Platforms
70
50
18
3
3
Products / Services
42
17
10
8
7
MITRE Techniques
32
20
19
19
18
CVEs
12
10
9
1
1
Detects Palo Alto Networks PAN-OS PHP RCE threat hits (PHP2Shell / CVE-2026-109618 / CVE-2026-109619) or inbound HTTPS connections to the management interface from non-private external sources.
Detects a Node.js web server process initiating a child process that is a known command shell or download utility, which is indicative of post-exploitation activity such as remote code execution.
Detects PHP request memory exhaustion fatal errors in web server error logs, corresponding to the OOM condition abused by PHP2Shell (CVE-2026-109618 / CVE-2026-109619) exploitation attempts.
Detects web server worker processes (php-fpm, apache2, httpd, nginx) or PHP interpreters spawning shell or reconnaissance utilities (sh, bash, curl, wget, id, whoami), consistent with post-exploitation activity such as PHP2Shell remote code execution.
Detects HTTP requests carrying a Brotli Content-Encoding request body, which serves as the delivery vector for Node2Shell (CVE-2026-111497), an out-of-bounds write vulnerability in the Brotli decoder bundled with Node.js and Bun.
Detects a PHP interpreter or PHP worker process (php-fpm, php-cgi, Apache httpd/apache2, or nginx workers) writing a new PHP-related script file into web root, upload, or temp directories. This is indicative of a webshell drop pattern following an unauthenticated remote code execution vulnerability.
Detects post-exploitation activity following PHP2Shell RCE vulnerabilities on Linux, where a web server or PHP worker process or web server user creates cron persistence, modifies SSH authorized_keys, or launches reverse shell one-liners.
Detects a Node.js or Bun process spawning a shell or common download utility on Linux, indicating potential post-exploitation activity such as remote code execution (e.g., CVE-2026-111497).
Detects web requests attempting to exploit PHP-CGI command-line argument injection vulnerabilities (such as CVE-2012-1823 or the soft-hyphen variant CVE-2024-4577) or inject PHP configuration directives (e.g., allow_url_include, auto_prepend_file, php://input) via query strings or URIs to achieve pre-authentication remote code execution.
Detects Linux process creation where a Node.js or Bun runtime spawns a shell or download utility as an anomalous child process (post-exploitation of the Brotli decoder out-of-bounds write, CVE-2026-111497), or where the Node2Shell PoC python script is run.
Page 1 of 9