Nextcloud Collabora Built-in CODE Server: CVE-2026-110447 Unauthenticated Command Injection and Web Shells

// HUNT: Web server account spawns a shell carrying injection markers (CVE-2026-110447 exploitation)
// MITRE: T1190, T1059.004, T1027, T1140 | CONF: high  FP: low  COST: low
// REQUIRES: Falcon Linux sensor on the Nextcloud host; ProcessRollup2 (Linux) with UserName + CommandLine
// FALSE POSITIVES: admin scripts run as the web account that legitimately decode base64 through a shell
// LOOKBACK: 30d (set in the time picker; first reported exploitation 2026-09-10)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| event_platform=Lin
| UserName=/^(www-data|apache|nginx|php-fpm|httpd|nobody|wwwrun|www)$/i
| FileName=/^(sh|bash|dash|zsh|ksh)$/i
| CommandLine=/\$\{IFS\}|base64(\$\{IFS\}|\s)+-d|%2e%2e|%24%28/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)
| sort(@timestamp, order=desc)

event.type = 'Process Creation' endpoint.os = 'linux' tgt.process.cmdline = *
| limit 5
| columns event.time, endpoint.os, src.process.user, tgt.process.name, tgt.process.cmdline

// HUNT: Web server account spawns a shell carrying injection markers (CVE-2026-110447 exploitation)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1190, T1059.004, T1027, T1140
// CONF: high | FP: low
// FALSE POSITIVES: admin scripts run as the web account that legitimately decode base64 through a shell
// EQUIVALENCE: equivalent-with-schema-assumptions - Same Linux process-creation predicate: a shell image started by a web server account whose command line carries an IFS expansion, a base64 decode, an encoded traversal or an encoded command substitution. The regex is case-insensitive by default, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne Linux agent process-creation telemetry on the Nextcloud host
// TUNING: Exclude admin scripts run as the web account that legitimately decode base64 through a shell, per host, after a baseline review.
// LOOKBACK: 30d (set in the time picker; first reported exploitation 2026-09-10)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A shell started by a process the agent did not observe starting is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' endpoint.os = 'linux' src.process.user matches '^(www-data|apache|nginx|php-fpm|httpd|nobody|wwwrun|www)$' tgt.process.name in:anycase ('sh', 'bash', 'dash', 'zsh', 'ksh') tgt.process.cmdline matches '\\$\\{IFS\\}|base64(\\$\\{IFS\\}|\\s)+-d|%2e%2e|%24%28'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, AccountName, FileName, ProcessCommandLine
| take 5

// HUNT: Web server account spawns a shell carrying injection markers (CVE-2026-110447 exploitation)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1190, T1059.004, T1027, T1140
// CONF: high | FP: low
// FALSE POSITIVES: admin scripts run as the web account that legitimately decode base64 through a shell
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a shell image started under a web server account with an injection marker in the command line. The regex carries (?i), which reproduces the CQL /i intent. The creating process is InitiatingProcessFileName.
// REQUIRES: Defender for Endpoint on Linux process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude admin scripts run as the web account that legitimately decode base64 through a shell, per host, after a baseline review.
// LOOKBACK: 30d (Advanced Hunting retention is 30 days)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A shell started by a process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where AccountName in~ ("www-data", "apache", "nginx", "php-fpm", "httpd", "nobody", "wwwrun", "www")
| where FileName in~ ("sh", "bash", "dash", "zsh", "ksh")
| where ProcessCommandLine matches regex @"(?i)\$\{IFS\}|base64(\$\{IFS\}|\s)+-d|%2e%2e|%24%28"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Command-substitution text inside the Collabora CODE server launch arguments
// MITRE: T1190, T1059.004, T1027 | CONF: high  FP: low  COST: low
// REQUIRES: Falcon Linux sensor on the Nextcloud host; ProcessRollup2 (Linux) with CommandLine
// FALSE POSITIVES: none known; a hit on a host already at 26.4.303 or later is an attempt, not a compromise
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| event_platform=Lin
| FileName=/^(bash|sh|dash|AppRun|coolwsd|coolforkit-ns|Collabora_Online\.AppImage)$/i
| CommandLine=/remote_font_config\.url=\S*(\$\(|\$\{IFS\}|%24%28)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)
| sort(@timestamp, order=desc)

event.type = 'Process Creation' endpoint.os = 'linux' tgt.process.cmdline = *
| limit 5
| columns event.time, endpoint.os, tgt.process.name, tgt.process.cmdline

// HUNT: Command-substitution text inside the Collabora CODE server launch arguments
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1190, T1059.004, T1027
// CONF: high | FP: low
// FALSE POSITIVES: none known; a hit on a host already at 26.4.303 or later is an attempt, not a compromise
// EQUIVALENCE: equivalent-with-schema-assumptions - Same Linux process-creation predicate: a shell or Collabora launcher image whose command line carries a remote_font_config.url argument followed by command-substitution text. Image names match case-insensitively through in:anycase, reproducing the CQL /i intent.
// REQUIRES: SentinelOne Linux agent process-creation telemetry on the Nextcloud host
// TUNING: None known. A hit on a host already at 26.4.303 or later is an attempt, not a compromise.
// LOOKBACK: 30d (set in the time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A launch by a process the agent did not observe starting is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' endpoint.os = 'linux' tgt.process.name in:anycase ('bash', 'sh', 'dash', 'AppRun', 'coolwsd', 'coolforkit-ns', 'Collabora_Online.AppImage') tgt.process.cmdline matches 'remote_font_config\\.url=\\S*(\\$\\(|\\$\\{IFS\\}|%24%28)'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: Command-substitution text inside the Collabora CODE server launch arguments
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1190, T1059.004, T1027
// CONF: high | FP: low
// FALSE POSITIVES: none known; a hit on a host already at 26.4.303 or later is an attempt, not a compromise
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a shell or Collabora launcher image whose command line carries a remote_font_config.url argument followed by command-substitution text. The regex carries (?i) and the image names use in~, reproducing the CQL /i intent.
// REQUIRES: Defender for Endpoint on Linux process-creation telemetry (DeviceProcessEvents)
// TUNING: None known. A hit on a host already at 26.4.303 or later is an attempt, not a compromise.
// LOOKBACK: 30d (Advanced Hunting retention is 30 days)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A launch by a process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where FileName in~ ("bash", "sh", "dash", "AppRun", "coolwsd", "coolforkit-ns", "Collabora_Online.AppImage")
| where ProcessCommandLine matches regex @"(?i)remote_font_config\.url=\S*(\$\(|\$\{IFS\}|%24%28)"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Web server account shell baseline, rare command lines first
// MITRE: T1505.003, T1059.004 | CONF: medium  FP: medium  COST: low
// REQUIRES: Falcon Linux sensor on the Nextcloud host; ProcessRollup2 (Linux)
// FALSE POSITIVES: stock CODE server launch, preview generators, backup or housekeeping hooks run via sh -c
// TUNING: baseline the stock launch line (bash -c wrapping Collabora_Online.AppImage, no $( or ${IFS}) over 30 days, then exclude it per host; Q1 and Q2 still catch the injected variant
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| event_platform=Lin
| UserName=/^(www-data|apache|nginx|php-fpm|httpd|nobody|wwwrun|www)$/i
| FileName=/^(sh|bash|dash)$/i
| groupBy([ComputerName, UserName, ParentBaseFileName, FileName], function=[count(as=execs), collect(CommandLine, limit=5)])
| sort(execs, order=asc, limit=200)

event.type = 'Process Creation' endpoint.os = 'linux' tgt.process.name = *
| limit 5
| columns endpoint.os, endpoint.name, src.process.user, tgt.process.name

// HUNT: Web server account shell baseline, rare command lines first
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1505.003, T1059.004
// CONF: medium | FP: medium
// FALSE POSITIVES: stock CODE server launch, preview generators, backup or housekeeping hooks run via sh -c
// EQUIVALENCE: approximate-analytic - Same baseline population and grouping: shells started by a web server account, counted per host, account, creating process and shell, rarest first. The CQL keeps up to five distinct command lines per group; PowerQuery any() keeps one sample command line.
// REQUIRES: SentinelOne Linux agent process-creation telemetry on the Nextcloud host
// TUNING: Baseline the stock launch line (bash -c wrapping Collabora_Online.AppImage, no command substitution or IFS expansion) over 30 days, then exclude it per host. Q1 and Q2 still catch the injected variant.
// LOOKBACK: 30d (set in the time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Only one sample command line per group is returned, where the CQL returns up to five; pivot on the group to see the rest.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' endpoint.os = 'linux' src.process.user matches '^(www-data|apache|nginx|php-fpm|httpd|nobody|wwwrun|www)$' tgt.process.name in:anycase ('sh', 'bash', 'dash')
| group execs=count(), sample_cmdline=any(tgt.process.cmdline) by endpoint.name, src.process.user, src.process.name, tgt.process.name
| sort +execs
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, AccountName, FileName, ProcessCommandLine
| take 5

// HUNT: Web server account shell baseline, rare command lines first
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1505.003, T1059.004
// CONF: medium | FP: medium
// FALSE POSITIVES: stock CODE server launch, preview generators, backup or housekeeping hooks run via sh -c
// EQUIVALENCE: equivalent-with-schema-assumptions - Same baseline population and grouping: shells started under a web server account, counted per host, account, initiating process and shell, rarest first, with up to five distinct command lines kept per group through make_set.
// REQUIRES: Defender for Endpoint on Linux process-creation telemetry (DeviceProcessEvents)
// TUNING: Baseline the stock launch line (bash -c wrapping Collabora_Online.AppImage, no command substitution or IFS expansion) over 30 days, then exclude it per host. Q1 and Q2 still catch the injected variant.
// LOOKBACK: 30d (Advanced Hunting retention is 30 days)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A shell started by a process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where AccountName in~ ("www-data", "apache", "nginx", "php-fpm", "httpd", "nobody", "wwwrun", "www")
| where FileName in~ ("sh", "bash", "dash")
| summarize Execs = count(), SampleCommandLines = make_set(ProcessCommandLine, 5) by DeviceName, AccountName, InitiatingProcessFileName, FileName
| sort by Execs asc
| take 200

// HUNT: Web server account hunting for credential stores and cryptocurrency wallets
// MITRE: T1083, T1552.001, T1555.005, T1005 | CONF: high  FP: low  COST: low
// REQUIRES: Falcon Linux sensor on the Nextcloud host; ProcessRollup2 (Linux) with CommandLine
// FALSE POSITIVES: an AV or backup job running as the web account that enumerates these file types
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| event_platform=Lin
| UserName=/^(www-data|apache|nginx|php-fpm|httpd|nobody|wwwrun|www)$/i
| CommandLine=/\.kdbx|wallet\.dat|keystore\.json|bitwarden|1password|\.bitcoin|\.electrum|\.monero|\.ethereum/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)
| sort(@timestamp, order=desc)

event.type = 'Process Creation' endpoint.os = 'linux' tgt.process.cmdline = *
| limit 5
| columns event.time, endpoint.os, src.process.user, tgt.process.cmdline

// HUNT: Web server account hunting for credential stores and cryptocurrency wallets
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1083, T1552.001, T1555.005, T1005
// CONF: high | FP: low
// FALSE POSITIVES: an AV or backup job running as the web account that enumerates these file types
// EQUIVALENCE: equivalent-with-schema-assumptions - Same Linux process-creation predicate: any process started by a web server account whose command line names a password vault, wallet or keystore file or directory. The regex is case-insensitive by default, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne Linux agent process-creation telemetry on the Nextcloud host
// TUNING: Exclude AV or backup jobs run as the web account that enumerate these file types, per host, after a baseline review.
// LOOKBACK: 30d (set in the time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Access to these files through a library call, with no process command line naming them, is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' endpoint.os = 'linux' src.process.user matches '^(www-data|apache|nginx|php-fpm|httpd|nobody|wwwrun|www)$' tgt.process.cmdline matches '\\.kdbx|wallet\\.dat|keystore\\.json|bitwarden|1password|\\.bitcoin|\\.electrum|\\.monero|\\.ethereum'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, AccountName, ProcessCommandLine
| take 5

// HUNT: Web server account hunting for credential stores and cryptocurrency wallets
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1083, T1552.001, T1555.005, T1005
// CONF: high | FP: low
// FALSE POSITIVES: an AV or backup job running as the web account that enumerates these file types
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: any process started under a web server account whose command line names a password vault, wallet or keystore file or directory. The regex carries (?i), which reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint on Linux process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude AV or backup jobs run as the web account that enumerate these file types, per host, after a baseline review.
// LOOKBACK: 30d (Advanced Hunting retention is 30 days)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Access to these files through a library call, with no process command line naming them, is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where AccountName in~ ("www-data", "apache", "nginx", "php-fpm", "httpd", "nobody", "wwwrun", "www")
| where ProcessCommandLine matches regex @"(?i)\.kdbx|wallet\.dat|keystore\.json|bitwarden|1password|\.bitcoin|\.electrum|\.monero|\.ethereum"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Web server account running recon, download or sudo commands
// MITRE: T1082, T1033, T1105, T1567, T1548.003 | CONF: medium  FP: medium  COST: low
// REQUIRES: Falcon Linux sensor on the Nextcloud host; ProcessRollup2 (Linux)
// FALSE POSITIVES: health checks or update scripts that run curl or wget as the web account
// TUNING: exclude known health-check command lines per host; rank by the webhook.site and base64 -d markers, and always escalate any sudo or su attempt by the web account
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| event_platform=Lin
| UserName=/^(www-data|apache|nginx|php-fpm|httpd|nobody|wwwrun|www)$/i
| FileName=/^(curl|wget|base64|uname|id|whoami|hostname|sudo|su)$/i
| groupBy([ComputerName, UserName, FileName], function=[count(as=execs), collect(CommandLine, limit=5)])
| sort(execs, order=desc, limit=200)

event.type = 'Process Creation' endpoint.os = 'linux' tgt.process.name = *
| limit 5
| columns endpoint.os, endpoint.name, src.process.user, tgt.process.name

// HUNT: Web server account running recon, download or sudo commands
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1082, T1033, T1105, T1567, T1548.003
// CONF: medium | FP: medium
// FALSE POSITIVES: health checks or update scripts that run curl or wget as the web account
// EQUIVALENCE: approximate-analytic - Same population and grouping: recon, download and privilege commands started by a web server account, counted per host, account and command, busiest first. The CQL keeps up to five distinct command lines per group; PowerQuery any() keeps one sample command line.
// REQUIRES: SentinelOne Linux agent process-creation telemetry on the Nextcloud host
// TUNING: Exclude known health-check command lines per host. Rank by the webhook.site and base64 -d markers, and always escalate any sudo or su attempt by the web account.
// LOOKBACK: 30d (set in the time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Only one sample command line per group is returned, where the CQL returns up to five; pivot on the group to see the rest.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' endpoint.os = 'linux' src.process.user matches '^(www-data|apache|nginx|php-fpm|httpd|nobody|wwwrun|www)$' tgt.process.name in:anycase ('curl', 'wget', 'base64', 'uname', 'id', 'whoami', 'hostname', 'sudo', 'su')
| group execs=count(), sample_cmdline=any(tgt.process.cmdline) by endpoint.name, src.process.user, tgt.process.name
| sort -execs
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, AccountName, FileName, ProcessCommandLine
| take 5

// HUNT: Web server account running recon, download or sudo commands
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1082, T1033, T1105, T1567, T1548.003
// CONF: medium | FP: medium
// FALSE POSITIVES: health checks or update scripts that run curl or wget as the web account
// EQUIVALENCE: equivalent-with-schema-assumptions - Same population and grouping: recon, download and privilege commands started under a web server account, counted per host, account and command, busiest first, with up to five distinct command lines kept per group through make_set.
// REQUIRES: Defender for Endpoint on Linux process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude known health-check command lines per host. Rank by the webhook.site and base64 -d markers, and always escalate any sudo or su attempt by the web account.
// LOOKBACK: 30d (Advanced Hunting retention is 30 days)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A command started by a process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where AccountName in~ ("www-data", "apache", "nginx", "php-fpm", "httpd", "nobody", "wwwrun", "www")
| where FileName in~ ("curl", "wget", "base64", "uname", "id", "whoami", "hostname", "sudo", "su")
| summarize Execs = count(), SampleCommandLines = make_set(ProcessCommandLine, 5) by DeviceName, AccountName, FileName
| sort by Execs desc
| take 200

// HUNT: Reported attacker IPs and webhook.site callbacks on Linux hosts
// MITRE: T1190, T1071.001, T1567 | CONF: medium  FP: low  COST: low
// REQUIRES: NetworkReceiveAcceptIP4 / NetworkConnectIP4 / DnsRequest on Linux (sensor-version and policy dependent; validate in tenant)
// FALSE POSITIVES: developers testing webhooks from the same host; the IPs are opportunistic and may be reassigned
// LOOKBACK: 30d (exploitation first reported 2026-09-10)
#event_simpleName=/^(DnsRequest|NetworkConnectIP4|NetworkReceiveAcceptIP4)$/
| event_platform=Lin
| (DomainName=/(^|\.)webhook\.site$/i or RemoteAddressIP4=/^(139\.28\.18\.122|89\.38\.98\.50)$/)
| table([@timestamp, ComputerName, #event_simpleName, ContextBaseFileName, RemoteAddressIP4, RemotePort, DomainName], limit=max)
| sort(@timestamp, order=desc)

event.type in ('DNS Resolved', 'IP Connect') endpoint.os = 'linux'
| limit 5
| columns event.time, event.type, endpoint.os, event.dns.request, dst.ip.address, src.ip.address

// HUNT: Reported attacker IPs and webhook.site callbacks on Linux hosts
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1190, T1071.001, T1567
// CONF: medium | FP: low
// FALSE POSITIVES: developers testing webhooks from the same host; the IPs are opportunistic and may be reassigned
// EQUIVALENCE: approximate-analytic - Same indicators on the same telemetry classes: DNS lookups of webhook.site and network connections to or from the two reported addresses. Inbound connections are read from IP Connect events with the reported address on either side, because a separate accept event is not attested.
// REQUIRES: SentinelOne Linux agent DNS and network telemetry (sensor version and policy dependent; validate in tenant)
// TUNING: Exclude developer hosts that test webhooks. The two addresses are opportunistic and may be reassigned, so treat an address-only hit as a lead.
// LOOKBACK: 30d (set in the time picker; exploitation first reported 2026-09-10)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Linux DNS and inbound-accept telemetry depend on agent version and policy; a clean result is not proof of no contact.
// VALIDATION LEVEL: static-reviewed
event.type in ('DNS Resolved', 'IP Connect') endpoint.os = 'linux' (event.dns.request in:anycase ('webhook.site') or event.dns.request matches '\\.webhook\\.site$' or dst.ip.address in ('139.28.18.122', '89.38.98.50') or src.ip.address in ('139.28.18.122', '89.38.98.50'))
| columns event.time, endpoint.name, event.type, src.process.name, src.ip.address, dst.ip.address, dst.port.number, event.dns.request
| sort -event.time
| limit 1000

DeviceNetworkEvents
| where Timestamp > ago(1d)
| project Timestamp, RemoteIP, RemoteUrl
| take 5

// HUNT: Reported attacker IPs and webhook.site callbacks on Linux hosts
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1190, T1071.001, T1567
// CONF: medium | FP: low
// FALSE POSITIVES: developers testing webhooks from the same host; the IPs are opportunistic and may be reassigned
// EQUIVALENCE: approximate-analytic - Same indicators by a different analytic: connections to or from the two reported addresses, and connections whose recorded URL is webhook.site or a subdomain. A DNS lookup with no resulting connection is not visible here.
// REQUIRES: Defender for Endpoint on Linux network telemetry (DeviceNetworkEvents)
// TUNING: Exclude developer hosts that test webhooks. The two addresses are opportunistic and may be reassigned, so treat an address-only hit as a lead.
// LOOKBACK: 30d (Advanced Hunting retention is 30 days)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A name lookup with no resulting connection, and a connection with an empty RemoteUrl, are not captured by the webhook.site predicate; a connection to the reported addresses is.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(30d)
| where RemoteUrl =~ "webhook.site" or RemoteUrl endswith ".webhook.site" or RemoteIP in ("139.28.18.122", "89.38.98.50")
| project Timestamp, ReportId, DeviceId, DeviceName, ActionType, InitiatingProcessFileName, RemoteIP, RemotePort, RemoteUrl
| sort by Timestamp desc
| take 1000

// HUNT: Web server account outbound connections to rare external addresses
// MITRE: T1071.001, T1105, T1567 | CONF: low  FP: medium  COST: medium
// REQUIRES: NetworkConnectIP4 (Linux) joined to ProcessRollup2 on aid + process id
// FALSE POSITIVES: Nextcloud federation, app store and update checks, SMTP, push notification relays
// TUNING: exclude your known federation, mail and update destinations; keep only destinations seen from one or two hosts
// LOOKBACK: 7d
#event_simpleName=NetworkConnectIP4
| event_platform=Lin
| RemoteAddressIP4!=/^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|127\.|169\.254\.)/
| rename(field=ContextProcessId_decimal, as=TargetProcessId_decimal)
| join(query={#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/ | event_platform=Lin | UserName=/^(www-data|apache|nginx|php-fpm|httpd|nobody|wwwrun|www)$/i}, field=[aid, TargetProcessId_decimal], include=[UserName, FileName, CommandLine])
| groupBy([RemoteAddressIP4, RemotePort], function=[count(ComputerName, distinct=true, as=hosts), count(aid, as=conns), collect([FileName, CommandLine], limit=5)])
| sort(hosts, order=asc, limit=200)

event.type = 'IP Connect' endpoint.os = 'linux' dst.ip.address = *
| limit 5
| columns endpoint.os, endpoint.name, src.process.user, dst.ip.address, dst.port.number

// HUNT: Web server account outbound connections to rare external addresses
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1071.001, T1105, T1567
// CONF: low | FP: medium
// FALSE POSITIVES: Nextcloud federation, app store and update checks, SMTP, push notification relays
// EQUIVALENCE: approximate-analytic - Same hunt without the join: SentinelOne IP Connect events carry the connecting process and its account, so the web-account filter applies to the connection event directly. Private, loopback and link-local destinations are excluded, then destinations are counted per remote address and port, fewest hosts first. The CQL keeps up to five distinct process and command line pairs; PowerQuery any() keeps one of each.
// REQUIRES: SentinelOne Linux agent network telemetry with the connecting process and account
// TUNING: Exclude your known federation, mail and update destinations. Keep only destinations seen from one or two hosts.
// LOOKBACK: 7d (set in the time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Only one sample process and command line per destination is returned, where the CQL returns up to five pairs.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect' endpoint.os = 'linux' src.process.user matches '^(www-data|apache|nginx|php-fpm|httpd|nobody|wwwrun|www)$' dst.ip.address = * !(net_rfc1918(dst.ip.address)) !(net_ipsubnet(dst.ip.address, '127.0.0.0/8')) !(net_ipsubnet(dst.ip.address, '169.254.0.0/16'))
| group hosts=estimate_distinct(endpoint.name), conns=count(), sample_process=any(src.process.name), sample_cmdline=any(src.process.cmdline) by dst.ip.address, dst.port.number
| sort +hosts
| limit 200

DeviceNetworkEvents
| where Timestamp > ago(1d)
| project Timestamp, ActionType, InitiatingProcessAccountName, RemoteIPType, RemoteIP, RemotePort
| take 5

// HUNT: Web server account outbound connections to rare external addresses
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1071.001, T1105, T1567
// CONF: low | FP: medium
// FALSE POSITIVES: Nextcloud federation, app store and update checks, SMTP, push notification relays
// EQUIVALENCE: approximate-analytic - Same hunt without the join: DeviceNetworkEvents carries the initiating process and its account, so the web-account filter applies to the connection row directly. Public destinations are selected through RemoteIPType, then counted per remote address and port, fewest hosts first.
// REQUIRES: Defender for Endpoint on Linux network telemetry (DeviceNetworkEvents)
// TUNING: Exclude your known federation, mail and update destinations. Keep only destinations seen from one or two hosts.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A connection the sensor recorded with a different ActionType, and a connection that RemoteIPType does not classify, are not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(7d)
| where ActionType == "ConnectionSuccess"
| where InitiatingProcessAccountName in~ ("www-data", "apache", "nginx", "php-fpm", "httpd", "nobody", "wwwrun", "www")
| where RemoteIPType == "Public"
| summarize Hosts = dcount(DeviceName), Conns = count(), SampleProcesses = make_set(InitiatingProcessFileName, 5), SampleCommandLines = make_set(InitiatingProcessCommandLine, 5) by RemoteIP, RemotePort
| sort by Hosts asc
| take 200

// HUNT: PHP files created or modified under the Collabora app path or matching the web shell name pattern
// MITRE: T1505.003, T1105 | CONF: medium  FP: medium  COST: low
// REQUIRES: FileOpenInfo or CriticalFileModified on Linux for the Nextcloud apps path (policy dependent; validate in tenant)
// FALSE POSITIVES: richdocumentscode app upgrades writing new app files; the stock proxy.php is excluded because it is a legitimate app file
// TUNING: suppress writes during a change window for the app upgrade; always escalate names matching the shx or shrf pattern regardless of path
// LOOKBACK: 30d
#event_simpleName=/^(FileOpenInfo|CriticalFileModified)$/
| event_platform=Lin
| FileName=/\.php$/i
| FileName!=/^proxy\.php$/i
| (FileName=/^sh(x|rf)[0-9a-f]{4,5}\.php$/i or TargetFileName=*richdocumentscode*)
| table([@timestamp, ComputerName, #event_simpleName, UserName, ContextBaseFileName, TargetFileName], limit=200)
| sort(@timestamp, order=desc)

event.type in ('File Creation', 'File Modification') endpoint.os = 'linux' tgt.file.path = *
| limit 5
| columns event.time, event.type, endpoint.os, tgt.file.path

// HUNT: PHP files created or modified under the Collabora app path or matching the web shell name pattern
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1505.003, T1105
// CONF: medium | FP: medium
// FALSE POSITIVES: richdocumentscode app upgrades writing new app files; the stock proxy.php is excluded because it is a legitimate app file
// EQUIVALENCE: equivalent-with-schema-assumptions - Same file predicate: a PHP file written on Linux whose name matches the web shell pattern or whose path contains richdocumentscode, excluding the stock proxy.php. The file name is read from the end of tgt.file.path because a separate file name field is not attested. Matching is case-insensitive by default, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne Linux agent file telemetry for the Nextcloud apps path (policy dependent; validate in tenant)
// TUNING: Suppress writes during a change window for the app upgrade. Always escalate names matching the shx or shrf pattern regardless of path.
// LOOKBACK: 30d (set in the time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: File telemetry on Linux depends on agent version and policy; a clean result is not proof that no file was written.
// VALIDATION LEVEL: static-reviewed
event.type in ('File Creation', 'File Modification') endpoint.os = 'linux' tgt.file.path matches '\\.php$' !(tgt.file.path matches '(^|/)proxy\\.php$') (tgt.file.path matches '(^|/)sh(x|rf)[0-9a-f]{4,5}\\.php$' or tgt.file.path contains 'richdocumentscode')
| columns event.time, endpoint.name, event.type, src.process.user, src.process.name, tgt.file.path
| sort -event.time
| limit 200

DeviceFileEvents
| where Timestamp > ago(1d)
| project Timestamp, ActionType, FileName, FolderPath
| take 5

// HUNT: PHP files created or modified under the Collabora app path or matching the web shell name pattern
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1505.003, T1105
// CONF: medium | FP: medium
// FALSE POSITIVES: richdocumentscode app upgrades writing new app files; the stock proxy.php is excluded because it is a legitimate app file
// EQUIVALENCE: equivalent-with-schema-assumptions - Same file predicate: a PHP file created or modified whose name matches the web shell pattern or whose folder path contains richdocumentscode, excluding the stock proxy.php. The regex carries (?i) and the name test uses =~ and endswith, reproducing the CQL /i intent.
// REQUIRES: Defender for Endpoint on Linux file telemetry (DeviceFileEvents)
// TUNING: Suppress writes during a change window for the app upgrade. Always escalate names matching the shx or shrf pattern regardless of path.
// LOOKBACK: 30d (Advanced Hunting retention is 30 days)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: File telemetry on Linux depends on sensor version and policy; a clean result is not proof that no file was written.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceFileEvents
| where Timestamp >= ago(30d)
| where ActionType in ("FileCreated", "FileModified")
| where FileName endswith ".php"
| where FileName !~ "proxy.php"
| where FileName matches regex @"(?i)^sh(x|rf)[0-9a-f]{4,5}\.php$" or FolderPath contains "richdocumentscode"
| project Timestamp, ReportId, DeviceId, DeviceName, ActionType, InitiatingProcessAccountName, InitiatingProcessFileName, FolderPath, FileName
| sort by Timestamp desc
| take 200