Georg Lauenstein
@gsecTrusted contributorCompletionist
11 followers458 downloads641 copies43 likes15,530 views
206 detections
Filters
Last updated
All Time
Detection languages
192
14
Categories
54
44
14
12
12
Platforms
71
31
6
5
3
Products / Services
12
9
8
4
4
MITRE Techniques
46
40
37
36
20
CVEs
3
3
2
2
1
Detects Windows web/PHP worker processes (php.exe, php-cgi.exe,
apache.exe, httpd.exe, lsphp.exe, nginx.exe) spawning unexpected command shells
or download utilities. Exploitation of CVE-2026-109618 / CVE-2026-109619 in core
PHP grants unauthenticated RCE; the child process is the observable artifact since
the memory corruption leaves no trace in the PHP logs. mod_php deployments are
the highest-risk configuration.
apache.exe, httpd.exe, lsphp.exe, nginx.exe) spawning unexpected command shells
or download utilities. Exploitation of CVE-2026-109618 / CVE-2026-109619 in core
PHP grants unauthenticated RCE; the child process is the observable artifact since
the memory corruption leaves no trace in the PHP logs. mod_php deployments are
the highest-risk configuration.
Detects exploitation of the PHP2Shell RCE vulnerabilities in core PHP
(CVE-2026-109618 out-of-memory corruption and CVE-2026-109619 stale global state),
which allow unauthenticated remote code execution delivered through malicious
multipart uploads. Successful exploitation causes the PHP-FPM/Apache/httpd/lsphp
worker, typically running as www-data, to spawn a system shell (sh, bash, cmd,
powershell) or a download utility (curl, wget) to retrieve a second-stage payload.
A web server process spawning an interactive shell is a high-fidelity indicator of
web application compromise and should be investigated immediately.
(CVE-2026-109618 out-of-memory corruption and CVE-2026-109619 stale global state),
which allow unauthenticated remote code execution delivered through malicious
multipart uploads. Successful exploitation causes the PHP-FPM/Apache/httpd/lsphp
worker, typically running as www-data, to spawn a system shell (sh, bash, cmd,
powershell) or a download utility (curl, wget) to retrieve a second-stage payload.
A web server process spawning an interactive shell is a high-fidelity indicator of
web application compromise and should be investigated immediately.
Detects script-driven (curl, wget, python) outbound connections to
AI/LLM API endpoints. The campaign uses legitimate AI platform APIs as covert
command, control, and exfiltration channels, blending malicious traffic with
approved web services to evade network-based detection.
AI/LLM API endpoints. The campaign uses legitimate AI platform APIs as covert
command, control, and exfiltration channels, blending malicious traffic with
approved web services to evade network-based detection.
Detects password spraying: a single source IP generating failed
logins against many distinct accounts in a short window. AI-assisted planning
can produce low-rate credential attacks designed to stay under per-account
lockout thresholds; the distinguishing signal is breadth across users rather
than volume per user.
logins against many distinct accounts in a short window. AI-assisted planning
can produce low-rate credential attacks designed to stay under per-account
lockout thresholds; the distinguishing signal is breadth across users rather
than volume per user.
Detects a burst of file modifications producing common
ransomware encryption extensions on a single host within a short window. This
captures the destructive-scripting / data-encryption impact behaviour that
AI-assisted cybercrime can drive, where a script rapidly renames or rewrites
large numbers of files after execution.
ransomware encryption extensions on a single host within a short window. This
captures the destructive-scripting / data-encryption impact behaviour that
AI-assisted cybercrime can drive, where a script rapidly renames or rewrites
large numbers of files after execution.
Detects cmd.exe launched from the Windows Run dialog (explorer.exe
parent) downloading a payload with a living-off-the-land transfer utility such as
certutil, bitsadmin or curl. ClickFix pasted commands frequently chain cmd.exe with
these built-in binaries to fetch the secondary malware stage.
parent) downloading a payload with a living-off-the-land transfer utility such as
certutil, bitsadmin or curl. ClickFix pasted commands frequently chain cmd.exe with
these built-in binaries to fetch the secondary malware stage.
Detects PowerShell being launched directly from the Windows Run dialog
(explorer.exe parent) with a hidden window and a download/execution cradle in the
command line. This is the core artifact of ClickFix campaigns, where the victim is
lured to an Amazon-themed decoy page, copies a pasted command, and executes it from
Run to retrieve and run the next-stage malware.
(explorer.exe parent) with a hidden window and a download/execution cradle in the
command line. This is the core artifact of ClickFix campaigns, where the victim is
lured to an Amazon-themed decoy page, copies a pasted command, and executes it from
Run to retrieve and run the next-stage malware.
Detects rundll32.exe executing inline JavaScript/VBScript via the
mshtml RunHTMLApplication export or a script payload staged in user-writable
directories. ClickFix chains abuse rundll32 to proxy script execution past
application controls without dropping a conventional executable.
mshtml RunHTMLApplication export or a script payload staged in user-writable
directories. ClickFix chains abuse rundll32 to proxy script execution past
application controls without dropping a conventional executable.
Detects a web browser spawning a script interpreter or dual-use
LOLBin, the execution hand-off typical of an AI-drafted phishing lure where the
victim clicks a link/attachment and content is immediately executed by
PowerShell, cmd, mshta, wscript or cscript. Legitimate browsers almost never
spawn these interpreters as direct children, making this a high-fidelity signal
of a browser-to-interpreter phishing chain as described for AI-assisted
cybercrime activity.
LOLBin, the execution hand-off typical of an AI-drafted phishing lure where the
victim clicks a link/attachment and content is immediately executed by
PowerShell, cmd, mshta, wscript or cscript. Legitimate browsers almost never
spawn these interpreters as direct children, making this a high-fidelity signal
of a browser-to-interpreter phishing chain as described for AI-assisted
cybercrime activity.
Detects a web server process (apache2, httpd, php-fpm) spawning a Unix shell (dash/sh) that executes discovery commands such as id, whoami, hostname, or find. This is the durable post-exploitation signature of the wp2shell WordPress pre-auth RCE chain (CVE-2026-63030, CVE-2026-60137), where a malicious plugin or webshell executes commands through the web stack.
Page 1 of 21