Goksel Atakan
@gokselatakanIstanbul, Turkiye GoXDR.fyiTrusted contributorCompletionist
0 followers35 downloads1,209 copies35 likes2,469 views
75 detections
Filters
Last updated
All Time
Detection languages
65
10
Categories
15
14
14
13
10
Platforms
28
20
16
13
13
Products / Services
16
14
11
11
8
MITRE Techniques
37
25
18
16
15
CVEs
3
2
2
1
1
Detects when a web server account (such as www-data, apache, nginx) spawns a shell (bash, sh, etc.), 'su', or 'unshare', which may indicate web application exploitation and post-compromise activity. The query ran without errors in a live tenant.
Detects indicators of compromise associated with a compromised AhsayCBS server, including connections to malicious infrastructure, execution of suspicious child processes or administrative utilities by cbssvcX64.exe, and the presence of known cryptominer artifacts and scripts. The query ran without errors in a live tenant.
Detects external Microsoft Teams messages containing support-related social engineering lures or originating from known malicious/IOC tenant domains, summarizing sender and thread metrics. The query ran without errors in a live tenant.
Detects PHP exposure to CVE-2026-109618 and CVE-2026-109619 (PHP2Shell): installed packages below the fixed versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12 or on branches the advisories do not cover, devices that Defender Vulnerability Management flags for either CVE, and PHP processes that ran in the last 30 days on devices with no PHP package in the inventory. Every row carries the live CISA KEV status of both CVEs and internet facing devices are listed first. A last row shows the KEV feed row count and newest entry date, so an empty result can be told apart from an empty or outdated feed. It does not show whether exploitation took place and appliances that embed PHP need their vendor advisories. The query ran without errors in a live tenant.
Inventory hunting query for the two critical PHP remote code execution vulnerabilities CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. PHP released the fixes on 21 October 2026 in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The query returns two kinds of rows. First, installed PHP packages in the Defender Vulnerability Management inventory whose version is below the fixed version of their branch or that belong to a branch the advisories do not cover (8.1 and older). Second, devices that Defender Vulnerability Management already associates with either CVE. Results show whether each device is internet facing and list those devices first. The query reads the Defender Vulnerability Management tables, so it runs in Defender XDR Advanced Hunting only. It lists installed versions and does not show which PHP build serves web requests or whether exploitation took place. Windows installs from zip archives are not inventoried and unusual package names are not matched. The second part can stay empty until Defender Vulnerability Management has processed the CVEs. The query follows the Microsoft Defender advanced hunting schemas and ran without errors in a live tenant.
Detects an address whose sign-ins are mostly failures across many accounts in a short window, with scripted clients and Storm-0940 campaign addresses flagged, which is how the password spray in Microsoft's ARTEX reporting looked. It does not cover the ConnectWise application sign-ins (service principal events) or a spray spread over many addresses. The query ran without errors in a live tenant.
Detects the Tensorlake npm compromise (tensorlake@0.5.144, Shai-Hulud) through the two payload hashes, gh-token-monitor persistence, node or bun running lib/setup.mjs or Math_Symbol.js and node or bun connections to iseekaigogo.com or public Ethereum RPC hosts. It needs Defender for Endpoint events from developer machines and does not see lockfile or package cache contents. The query ran without errors in a live tenant
Detects one identity reading secrets from several Azure Key Vaults in a day beyond its own 14 day baseline, which matches the bulk secret reads Microsoft reported after the ConnectWise application compromise. It needs the CloudKeyVaultEvents table, does not flag an identity that already reads many vaults every day and cannot show whether the reads were legitimate. The query ran without errors in a live tenant.
Detects malicious file hashes, suspicious process executions involving Node.js/Bun running setup scripts, schtasks/powershell persistence monitoring tasks, and connections to known domains/RPC endpoints associated with threat activity. The query ran without errors in a live tenant.
Detects Microsoft 365 session token replay as described in the Huntress token spray research: sign-ins from the campaign addresses, scripted clients (node or a bare Mozilla/5.0 user agent) using the Office, Authentication Broker or OfficeHome app IDs from an address new to the account, Device Registration Service access from a new address and one session seen from different operating systems and addresses. The campaign address list is short lived and serves as enrichment.
Page 2 of 8