Suraj A
@cytechCompletionist
0 followers115 downloads374 copies2 likes1,142 views
90 detections
Filters
Last updated
All Time
Detection languages
72
18
Categories
52
42
15
11
11
Platforms
70
50
18
3
3
Products / Services
42
17
10
8
7
MITRE Techniques
32
20
19
19
18
CVEs
12
10
9
1
1
Detects HTTP POST requests directed at PHP endpoints using scripting-library or vulnerability scanner user agents, which is consistent with PHP2Shell (CVE-2026-109618 / CVE-2026-109619) scanning and exploit probing activity.
Detects execution of a Python proof-of-concept script targeting CVE-2026-111497 that launches node child processes or runs related commands involving Brotli compression files and decompression functions.
Detects post-exploitation activity where a Node.js or Bun runtime process spawns a shell, interpreter, or network download utility, which could indicate exploitation such as CVE-2026-111497 (Node2Shell).
Detects segmentation fault or crash log messages related to ClickHouse server processes in syslog, which can indicate service disruption or exploitation attempts such as the Brotli request crash (HTTP2Shell/CVE-2026-111497).
Detects network connection and URL events involving IP address 147.135.36.162, identified as a malicious indicator of compromise from the Huntress php2shell advisory.
Detects package manager installations or executions spawned by an AI coding agent (such as claude, codex, or cursor) involving specific indicators like the 'function-color' package or running out of a Downloads working directory.
Detects repeated execution of the Tailscale VPN client using an authentication key (tskey-auth-) 5 or more times within a 1-hour window on the same device or account, which may indicate mass or rogue node enrollment.
Detects the presence of a specific malicious SHA256 file hash across device file events, process execution events, and image load events over a 30-day window using Microsoft Defender for Endpoint data.
Detects vulnerable installations of Node.js and Bun based on software inventory data to identify exposure to CVE-2026-111497 (Node2Shell).
Detects web server worker processes (such as PHP-FPM, Apache httpd, etc.) launching shells, interpreters, or download/network tools, which is a common post-exploitation pattern following remote code execution (RCE) vulnerabilities.
Page 2 of 9