PRODAFT USTA - TI map File Hash to CommonSecurityLog

LowSplunk security content

PHP Session Upload Progress with PHP Code in Upload Filename

This analytic detects multipart POST requests containing a PHPSESSID form field and an uploaded filename with a PHP opening tag. When observed with "PHP_SESSION_UPLOAD_PROGRESS" behavior, this may indicate an attempt to place executable PHP content into session-related data as part of PHP2Shell exploitation.

T1190

Written by: Raven TaitAttributed by Splunk security contentand 3 more authors
Licence: Apache License 2.0
Published: Oct 23, 2026

LowSplunk security content

PHP Session Upload Progress Serialized Payload in Upload Filename

This analytic detects multipart POST requests containing the "PHP_SESSION_UPLOAD_PROGRESS" form field and a serialized PHP structure in an uploaded filename. This combination may indicate an attempt to exploit PHP session upload-progress handling and can be associated with PHP2Shell activity.

T1190

Written by: Raven TaitAttributed by Splunk security contentand 3 more authors
Licence: Apache License 2.0
Published: Oct 23, 2026

LowSplunk security content

PHP Memory Exhaustion Exploitation Attempt via Multipart Request

This analytic correlates Apache and Nginx access and error logs when "multipart/form-data" requests and PHP memory-limit exhaustion errors occur for the same PID, host, and client. It extracts web request details and "PHP" error messages to support investigation of possible PHP2Shell exploitation attempts.

T1190

Written by: Onur Mustafa ErdoganAttributed by Splunk security contentand 3 more authors
Licence: Apache License 2.0
Published: Oct 23, 2026

InformationalSplunk security content

Large HTTP POST Request Resulting in Server Error

This analytic detects HTTP POST requests with a body of at least one megabyte that receive an HTTP 500 response. Large failed uploads can indicate attempts to trigger resource exhaustion or exploit vulnerable request handling, including behavior associated with PHP2Shell, but require investigation with related web and application logs.

T1190

Written by: Raven TaitAttributed by Splunk security contentand 3 more authors
Licence: Apache License 2.0
Published: Oct 23, 2026

InformationalSplunk security content

Windows Suspicious Child Process Spawned From WebServer

The following analytic identifies the execution of suspicious processes typically associated with WebShell activity on web servers. It detects when processes like `cmd.exe`, `powershell.exe`, or `bash.exe` are spawned by web server processes such as `w3wp.exe` or `nginx.exe`. This behavior is significant as it may indicate an adversary exploiting a web application vulnerability to install a WebShell, providing persistent access and command execution capabilities.

T1505.003

Written by: Steven DickAttributed by Splunk security content
Licence: Apache License 2.0
Published: Oct 23, 2026

MediumSplunk security content

Web or Application Server Spawning a Shell

The following analytic detects instances where Java, or Tomcat processes spawn a Linux shell, which may indicate exploitation attempts, such as those related to CVE-2021-44228 (Log4Shell). This detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process names and parent-child process relationships. This activity is significant as it can signify a compromised Java application, potentially leading to unauthorized shell access.

T1133T1190

Written by: Michael HaagAttributed by Splunk security contentand 2 more authors
Licence: Apache License 2.0
Published: Oct 23, 2026

InformationalSplunk security content

Inline PHP Code Execution

The following analytic detects PHP command-line interpreters executing code supplied directly on the command line with the CLI -r / --run options, or code supplied to PHPDBG through standard input. It covers common CLI executable names on Linux and Windows, including php.exe, php-win.exe, the legacy php-cli.exe name, versioned Linux php binaries, phpdbg, and FrankenPHP's php-cli subcommand. PHP-CGI and PHP-FPM are excluded because they do not support the PHP CLI inline -r option.

T1059

Written by: Nasreddine BencherchaliAttributed by Splunk security contentand 3 more authors
Licence: Apache License 2.0
Published: Oct 23, 2026

MediumMicrosoft Sentinel analytics

SAP BTP - Use of custom app with high or critical vulnerability

Identifies use of SAP BTP custom applications that have an open high or critical vulnerability finding (CVSS 7.0 or higher by default) from the SAP Application Vulnerability Report. Interactive XSUAA logins (authorization_code) are matched by OAuth client xsappname to the app name (for example 'sb-myapp!t123' matches 'myapp-approuter') in the same subaccount, as a name-based proxy for use rather than proof of execution or compromise.

T1190

Licence: MIT License
Published: Oct 23, 2026

HighMicrosoft Sentinel analytics

PIM Role Activation After Sign-In Without MFA or From New Country

'Detects Privileged Identity Management (PIM) role activations where the preceding sign-in did not use MFA, or came from a country not seen for that user in the prior 14 days. Either condition alone triggers the alert. The sign-in is linked to the activation heuristically: the sign-in from the same IP as the activation is preferred, otherwise the user''s most recent successful sign-in in the hour before the activation is used. The CorrelationMethod column shows which was applied.

T1078.004T1098.003

Licence: MIT License
Published: Oct 23, 2026

UnknownMicrosoft Sentinel analytics

HoneyForge - Top Attacking Source IPs

Identifies the source IP addresses that have interacted most frequently with HoneyForge deception sensors over the past 7 days. Repeat offenders across multiple sensors are especially high-priority - they indicate persistent reconnaissance or an automated scanner that missed the exclusion list. Use this query as a starting point for threat-intel enrichment and to decide which IPs warrant a block rule or further investigation.

T1590T1595

Licence: MIT License
Published: Oct 23, 2026

UnknownMicrosoft Sentinel analytics

HoneyForge - Repeated Probes from Same Source

Finds source IPs that have probed HoneyForge sensors on multiple distinct occasions separated by at least one hour, suggesting deliberate or scripted reconnaissance rather than a one-off event. A legitimate network scanner that hits a sensor once might be an oversight. One that returns hours or days later is a persistent threat.

T1590T1595

Licence: MIT License
Published: Oct 23, 2026

UnknownMicrosoft Sentinel analytics

HoneyForge - Off-Hours Sensor Activity

Surfaces HoneyForge sensor interactions that occurred outside normal business hours (before 07:00 or after 19:00 UTC, Monday to Friday, and all day on weekends). Off-hours activity from internal IPs is especially suspicious - it may indicate a compromised device operating autonomously or an insider threat. Adjust the hour thresholds to match your organisation's working hours if they differ from the defaults.

T1133T1595

Licence: MIT License
Published: Oct 23, 2026

UnknownMicrosoft Sentinel analytics

HoneyForge - High-Frequency Sensor Interactions

Detects source IPs generating an unusually high volume of events against HoneyForge sensors in a short window (more than 50 events in any 10-minute period). This pattern is characteristic of automated scanners, brute-force tools, or worm-like lateral movement. High-frequency hits deserve immediate triage - especially if the source is an internal IP, which would indicate a compromised or misconfigured device inside the network.

T1190T1595

Licence: MIT License
Published: Oct 23, 2026

UnknownMicrosoft Sentinel analytics

HoneyForge - Sensor Fleet Coverage and Health

Provides a per-sensor event summary for the past 30 days, giving visibility into which sensors are active, which are quiet, and which may be offline or misconfigured (no events in the last 10 minutes is the offline threshold). Use this query during routine operations to confirm full fleet coverage and identify any gaps in your deception layer before an attacker does.

T1590T1595

Licence: MIT License
Published: Oct 23, 2026

HighMicrosoft Sentinel analytics

HoneyForge - Deception Sensor Interaction

Detects an interaction with a HoneyForge deception sensor. Any activity involving a HoneyForge sensor must be treated as potentially unauthorised until validated by the security operations team. HoneyForge sensors are passive decoy devices - legitimate systems and users should never communicate with them. Any detected interaction may indicate network scanning, lateral movement, or an actively compromised device.

T1133T1190T1590T1595

Licence: MIT License
Published: Oct 23, 2026

MediumElastic detection rules

Potential PHP2Shell Exploitation Attempt

This rule detects a distinctive PHP out-of-memory fatal error associated with PHP2Shell exploitation attempts. The combination of an allowed-memory-size exhaustion and the location "Unknown on line 0" is produced before normal application execution and is an indicator of attempts to exploit PHP memory-safety vulnerabilities, including CVE-2026-109618 and CVE-2026-109619. The rule can detect unsuccessful as well as successful attempts and does not, by itself, confirm remote code execution.

T1190

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 23, 2026

MediumElastic detection rules

First Occurrence of a PHP Fatal Error on a Web Server

This rule identifies the first PHP fatal error observed on a web server during the configured history window. PHP fatal errors are not inherently malicious, but a newly observed fatal condition can indicate exploitation of a previously unseen application or PHP engine failure. The rule is intentionally generic so it can identify both known and novel exploit attempts that terminate PHP request processing.

T1190

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 23, 2026

MediumElastic detection rules

First Occurrence of a Web Server Segmentation Fault

This rule identifies the first segmentation fault, SIGSEGV, signal 11 termination, or Windows access-violation status observed in web-server error logs for a host during the configured history window. An unexpected web-server crash can indicate attempted exploitation of a memory-safety vulnerability, including attempts that fail before code execution, although software defects and resource problems can produce the same behavior.

T1190T1499T1499.004

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 23, 2026

High

Web Application Spawning Interpreted Script from Temporary Directory (Container Noexec Bypass)

Detects web server processes (php-fpm, apache2, httpd, caddy) spawning scripting interpreters (sh, bash, python, perl) with target scripts located in temporary or volatile memory directories (/tmp, /dev/shm, /var/tmp). This pattern bypasses filesystem noexec mount restrictions present in containerized environments during web RCE post-exploitation.

Written by: Good L.
Licence: MIT License
Published: Oct 22, 2026

High

PHP Worker Executing Shell Redirection Payload (PHP2Shell Constrained Execution)

Detects PHP worker processes (php-fpm, apache2, httpd) executing shell interpreters with input or output redirection syntax (e.g., sh</tmp/*, sh</dev/shm/*, sh<*). This pattern indicates exploit payloads operating under strict inline memory string constraints, such as the 14-byte zend_string carrier limit in php2shell (CVE-2026-109618 / CVE-2026-109619).

Written by: Good L.
Licence: MIT License
Published: Oct 22, 2026

High

Phantom Patched PHP-FPM Service Running Stale In-Memory Binary

Identifies hosts where php-fpm processes have been running continuously from memory despite package or binary updates on disk. Detects "phantom patching" where vulnerability scanners report systems as remediated while running processes remain vulnerable to CVE-2026-109618 and CVE-2026-109619.

Written by: Good L.
Licence: MIT License
Published: Oct 22, 2026

High

ClickFix Run Dialog Child Shell Execution (Win+R Clipboard Injection)

Detects interactive execution of command interpreters, download cradles, or encoded PowerShell commands directly spawned by Windows Explorer (Run Dialog). Detects initial access chains driven by ClickFix social engineering lures (fake CAPTCHA / browser updates abusing navigator.clipboard.writeText).

Written by: Good L.
Licence: MIT License
Published: Oct 22, 2026

High

PHP-FPM Worker Crash Thrashing (PHP2Shell Exploit Heap Grooming)

Detects abnormal velocity of PHP-FPM child worker respawns from the master process. Rapid worker recycling indicates repeated memory exhaustion (zend_bailout) or segmentation faults (SIGSEGV) characteristic of Use-After-Free heap grooming and exploitation attempts (CVE-2026-109618 / CVE-2026-109619).

Written by: Good L.
Licence: MIT License
Published: Oct 22, 2026

High

Vulnerable PHP Runtime Instances (CVE-2026-109618 / CVE-2026-109619 Exposure Assessment)

Discovers vulnerable PHP runtime instances across Linux (Ubuntu, Debian, RHEL) and Windows hosts using Defender Vulnerability Management (DeviceTvmSoftwareInventory). Assesses exposure to critical RCE vulnerabilities CVE-2026-109618 and CVE-2026-109619 across supported and EOL branches, including instances located behind WAFs and ALBs.

Written by: Good L.
Licence: MIT License
Published: Oct 22, 2026

High

PHP Worker Spawning Suspicious Child Shell (PHP2Shell Post-Exploitation)

Detects command shell or reconnaissance process spawning from PHP worker processes following CVE-2026-109618 / CVE-2026-109619 exploitation.

Licence: MIT License
Published: Oct 22, 2026

LowElastic detection rules

Potential RMM Execution from a Commonly Abused Web Service

Identifies execution of software whose reported code-signature subject matches a known remote monitoring and management (RMM) publisher with a download origin on a commonly abused web service. Adversaries use these services to deliver remote-access software during social engineering and intrusion campaigns.

T1105T1219T1219.002

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 22, 2026

UnknownMicrosoft Sentinel analytics

Netcraft Takedown - Latest record inventory

Latest takedown record state per `subject` for the last 7 days via `NetcraftTakedown_Latest` (`EventType == "takedown"` rolled up by Subject).

T1566T1583

Licence: MIT License
Published: Oct 22, 2026

UnknownMicrosoft Sentinel analytics

Netcraft Social - Result inventory

7-day inventory of latest Social results with platform, social type, and risk. Collapses deliveries to one row per ResultUuid via NetcraftSocialResult_Latest.

T1585T1593

Licence: MIT License
Published: Oct 22, 2026

UnknownMicrosoft Sentinel analytics

Netcraft Domain Detection - Result inventory

7-day inventory of latest Domain Detection results with risk, tag display_name flags, and infrastructure fields. Collapses deliveries to one row per DomainResultId via NetcraftDomainDetection_Latest.

T1583T1590

Licence: MIT License
Published: Oct 22, 2026

UnknownMicrosoft Sentinel analytics

Netcraft DDW Intelligence - Match inventory

7-day inventory of latest Deep & Dark Web intelligence matches (`match.discovered`) with priority, type, and source fields. Collapses deliveries to one row per MatchUuid via NetcraftDdwIntelligence_Latest.

T1593T1597

Licence: MIT License
Published: Oct 22, 2026

Detection rules

PRODAFT USTA - TI map File Hash to CommonSecurityLog

Detection logic

Detection requirements

MITRE ATT&CK mappings

From the source

Licence

Authorship

Detection rules