PHP2Shell: CVE-2026-109618 and CVE-2026-109619 Unauthenticated PHP Remote Code Execution

// HUNT: PHP2Shell web server or PHP worker spawns a shell
// MITRE: T1190, T1059.004, T1059.003, T1059.001 | CONF: high  FP: medium  COST: low
// REQUIRES: Falcon sensor on the web server (Linux or Windows); process creation with parent and command line
// FALSE POSITIVES: PHP mail() via sh -c sendmail, image or PDF converters launched through a shell, deploy hooks run by the web account
// TUNING: baseline ParentBaseFileName + CommandLine for 30 days before 2026-10-20, then exclude the known pairs per host; add | CommandLine!=/sendmail/i only after confirming no web account abuses it; any shell with -i, a URL, base64 or an IP in CommandLine stays in scope
// LOOKBACK: 30d (first reported exploitation 2026-10-17)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^(php-fpm[0-9.]*|php-cgi[0-9.]*|lsphp[0-9]*|frankenphp|httpd|apache2|nginx|litespeed|lshttpd|w3wp)(\.exe)?$/i
| FileName=/^(sh|bash|dash|zsh|ksh|ash|busybox|cmd|powershell|pwsh)(\.exe)?$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, SHA256HashData], limit=200)
| sort(@timestamp, order=desc)

event.type = 'Process Creation' src.process.name = * tgt.process.name = *
| limit 5
| columns event.time, event.type, src.process.name, tgt.process.name

// HUNT: PHP2Shell web server or PHP worker spawns a shell
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1190, T1059.004, T1059.003, T1059.001
// CONF: high | FP: medium
// FALSE POSITIVES: PHP mail() via sh -c sendmail, image or PDF converters launched through a shell, deploy hooks run by the web account
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate on the Process Creation event: the creator (src.process.name) is a web server or PHP worker and the new process (tgt.process.name) is a shell. Case-insensitive matches reproduces the CQL /i intent.
// REQUIRES: SentinelOne Linux or Windows agent on the web server with Process Creation events
// TUNING: Baseline the creator and command line pairs for 30 days, then exclude the known pairs per host. Any shell with -i, a URL, base64 or an IP in the command line stays in scope.
// LOOKBACK: 30d (set the console time picker; first reported exploitation 2026-10-17)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A shell started by a process the agent did not observe starting is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' src.process.name matches '^(php-fpm[0-9.]*|php-cgi[0-9.]*|lsphp[0-9]*|frankenphp|httpd|apache2|nginx|litespeed|lshttpd|w3wp)([.]exe)?$' tgt.process.name matches '^(sh|bash|dash|zsh|ksh|ash|busybox|cmd|powershell|pwsh)([.]exe)?$'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline, tgt.process.image.sha256
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, InitiatingProcessFileName, FileName
| take 5

// HUNT: PHP2Shell web server or PHP worker spawns a shell
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1190, T1059.004, T1059.003, T1059.001
// CONF: high | FP: medium
// FALSE POSITIVES: PHP mail() via sh -c sendmail, image or PDF converters launched through a shell, deploy hooks run by the web account
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the creator (InitiatingProcessFileName) is a web server or PHP worker and the created process (FileName) is a shell. The regex is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents) on Linux or Windows web servers
// TUNING: Baseline the creator and command line pairs for 30 days, then exclude the known pairs per host. Any shell with -i, a URL, base64 or an IP in the command line stays in scope.
// LOOKBACK: 30d (Advanced Hunting retention; first reported exploitation 2026-10-17)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A shell started by a process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where InitiatingProcessFileName matches regex @"(?i)^(php-fpm[0-9.]*|php-cgi[0-9.]*|lsphp[0-9]*|frankenphp|httpd|apache2|nginx|litespeed|lshttpd|w3wp)([.]exe)?$"
| where FileName matches regex @"(?i)^(sh|bash|dash|zsh|ksh|ash|busybox|cmd|powershell|pwsh)([.]exe)?$"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: PHP2Shell web server parent starts a download tool or interpreter
// MITRE: T1105, T1059.006, T1059.004, T1218 | CONF: medium  FP: medium  COST: low
// REQUIRES: Falcon sensor on the web server; process creation with parent and command line
// FALSE POSITIVES: application cache warmers, health checks, updater and cron scripts run through the web account
// TUNING: groupBy CommandLine over 30 days to find the stable set, then exclude those exact command lines; keep anything with a raw IP, an unusual TLD, a pipe to sh or bash, or a write to a temp folder
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^(php-fpm[0-9.]*|php-cgi[0-9.]*|lsphp[0-9]*|frankenphp|httpd|apache2|nginx|litespeed|lshttpd|w3wp)(\.exe)?$/i
| FileName=/^(curl|wget|python[0-9.]*|perl|ruby|nc|ncat|netcat|socat|tftp|ftp|certutil|bitsadmin|mshta|rundll32|regsvr32)(\.exe)?$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)
| sort(@timestamp, order=desc)

event.type = 'Process Creation' src.process.name = * tgt.process.name = *
| limit 5
| columns event.time, event.type, src.process.name, tgt.process.name

// HUNT: PHP2Shell web server parent starts a download tool or interpreter
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1105, T1059.006, T1059.004, T1218
// CONF: medium | FP: medium
// FALSE POSITIVES: application cache warmers, health checks, updater and cron scripts run through the web account
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate on the Process Creation event: the creator (src.process.name) is a web server or PHP worker and the new process (tgt.process.name) is a download tool or script interpreter. Case-insensitive matches reproduces the CQL /i intent.
// REQUIRES: SentinelOne Linux or Windows agent on the web server with Process Creation events
// TUNING: Group by command line over 30 days to find the stable set, then exclude those exact command lines. Keep anything with a raw IP, an unusual TLD, a pipe to sh or bash, or a write to a temp folder.
// LOOKBACK: 30d (set the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A tool started by a process the agent did not observe starting is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' src.process.name matches '^(php-fpm[0-9.]*|php-cgi[0-9.]*|lsphp[0-9]*|frankenphp|httpd|apache2|nginx|litespeed|lshttpd|w3wp)([.]exe)?$' tgt.process.name matches '^(curl|wget|python[0-9.]*|perl|ruby|nc|ncat|netcat|socat|tftp|ftp|certutil|bitsadmin|mshta|rundll32|regsvr32)([.]exe)?$'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, InitiatingProcessFileName, FileName
| take 5

// HUNT: PHP2Shell web server parent starts a download tool or interpreter
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1105, T1059.006, T1059.004, T1218
// CONF: medium | FP: medium
// FALSE POSITIVES: application cache warmers, health checks, updater and cron scripts run through the web account
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the creator (InitiatingProcessFileName) is a web server or PHP worker and the created process (FileName) is a download tool or script interpreter. The regex is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents) on Linux or Windows web servers
// TUNING: Summarize by command line over 30 days to find the stable set, then exclude those exact command lines. Keep anything with a raw IP, an unusual TLD, a pipe to sh or bash, or a write to a temp folder.
// LOOKBACK: 30d (Advanced Hunting retention)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A tool started by a process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where InitiatingProcessFileName matches regex @"(?i)^(php-fpm[0-9.]*|php-cgi[0-9.]*|lsphp[0-9]*|frankenphp|httpd|apache2|nginx|litespeed|lshttpd|w3wp)([.]exe)?$"
| where FileName matches regex @"(?i)^(curl|wget|python[0-9.]*|perl|ruby|nc|ncat|netcat|socat|tftp|ftp|certutil|bitsadmin|mshta|rundll32|regsvr32)([.]exe)?$"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: PHP2Shell reverse shell from a web account
// MITRE: T1059.004, T1059.006, T1071.001, T1095 | CONF: high  FP: low  COST: low
// REQUIRES: Falcon sensor on the web server; process creation with command line
// FALSE POSITIVES: authorized penetration testing and lab validation of this very flaw
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/(bash|sh)\s+-i|dev.tcp.[0-9a-z.\-]+.[0-9]+|mkfifo.*\b(nc|ncat|netcat)\b|\b(nc|ncat|netcat)\b.*\s-e\s|socat.*(exec|system):|python[0-9.]*\s+-c.*socket|perl\s+-e.*socket|php\s+-r.*fsockopen/i
| (ParentBaseFileName=/^(php-fpm[0-9.]*|php-cgi[0-9.]*|lsphp[0-9]*|frankenphp|httpd|apache2|nginx|litespeed|lshttpd|w3wp)(\.exe)?$/i or UserName=/^(www-data|apache|nginx|php-fpm|httpd|nobody|wwwrun|www|lighttpd)$/i)
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)
| sort(@timestamp, order=desc)

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, event.type, tgt.process.cmdline, src.process.name, src.process.user

// HUNT: PHP2Shell reverse shell from a web account
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1059.004, T1059.006, T1071.001, T1095
// CONF: high | FP: low
// FALSE POSITIVES: authorized penetration testing and lab validation of this very flaw
// EQUIVALENCE: equivalent-with-schema-assumptions - Same reverse shell command line patterns on Process Creation, limited to a web server or PHP worker creator or a web service account. Word boundaries and whitespace classes are written with bracket classes; the result is slightly broader than the CQL on boundaries.
// REQUIRES: SentinelOne Linux or Windows agent on the web server with Process Creation events
// TUNING: Exclude authorized penetration testing and lab validation hosts by endpoint name.
// LOOKBACK: 30d (set the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A reverse shell built inside a script file rather than on a command line is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.cmdline matches '(bash|sh)[ ]+-i|dev.tcp.[0-9a-z.-]+.[0-9]+|mkfifo.*(^|[ /])(nc|ncat|netcat)([ ]|$)|(^|[ /])(nc|ncat|netcat)([ ]|$).*[ ]-e[ ]|socat.*(exec|system):|python[0-9.]*[ ]+-c.*socket|perl[ ]+-e.*socket|php[ ]+-r.*fsockopen' (src.process.name matches '^(php-fpm[0-9.]*|php-cgi[0-9.]*|lsphp[0-9]*|frankenphp|httpd|apache2|nginx|litespeed|lshttpd|w3wp)([.]exe)?$' or src.process.user matches '^(www-data|apache|nginx|php-fpm|httpd|nobody|wwwrun|www|lighttpd)$')
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, ProcessCommandLine, InitiatingProcessFileName, AccountName
| take 5

// HUNT: PHP2Shell reverse shell from a web account
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1059.004, T1059.006, T1071.001, T1095
// CONF: high | FP: low
// FALSE POSITIVES: authorized penetration testing and lab validation of this very flaw
// EQUIVALENCE: equivalent-with-schema-assumptions - Same reverse shell command line patterns on process creation, limited to a web server or PHP worker creator or a web service account. Word boundaries and whitespace classes are written with bracket classes, slightly broader than the CQL. The regex is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents) on Linux or Windows web servers
// TUNING: Exclude authorized penetration testing and lab validation hosts by DeviceName.
// LOOKBACK: 30d (Advanced Hunting retention)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A reverse shell built inside a script file rather than on a command line is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where ProcessCommandLine matches regex @"(?i)(bash|sh)[ ]+-i|dev.tcp.[0-9a-z.-]+.[0-9]+|mkfifo.*(^|[ /])(nc|ncat|netcat)([ ]|$)|(^|[ /])(nc|ncat|netcat)([ ]|$).*[ ]-e[ ]|socat.*(exec|system):|python[0-9.]*[ ]+-c.*socket|perl[ ]+-e.*socket|php[ ]+-r.*fsockopen"
| where InitiatingProcessFileName matches regex @"(?i)^(php-fpm[0-9.]*|php-cgi[0-9.]*|lsphp[0-9]*|frankenphp|httpd|apache2|nginx|litespeed|lshttpd|w3wp)([.]exe)?$" or AccountName matches regex @"(?i)^(www-data|apache|nginx|php-fpm|httpd|nobody|wwwrun|www|lighttpd)$"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: PHP2Shell web account discovery and credential file reads
// MITRE: T1033, T1082, T1016, T1552.001, T1083 | CONF: medium  FP: medium  COST: low
// REQUIRES: Falcon sensor on the web server; process creation with command line
// FALSE POSITIVES: monitoring or backup scripts run as the web account that call id, hostname or read config files
// TUNING: exclude exact command lines from known monitoring and backup jobs per host; a web account reading id_rsa or cloud credential files has no routine reason and should not be excluded
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| (ParentBaseFileName=/^(php-fpm[0-9.]*|php-cgi[0-9.]*|lsphp[0-9]*|frankenphp|httpd|apache2|nginx|litespeed|lshttpd|w3wp)(\.exe)?$/i or UserName=/^(www-data|apache|nginx|php-fpm|httpd|nobody|wwwrun|www|lighttpd)$/i)
| CommandLine=/whoami|uname\s+-[a-z]|\bid\s*($|;|\|)|ifconfig|ipconfig|netstat|systeminfo|nltest|printenv|etc.passwd|etc.shadow|wp-config|\.env\b|settings\.php|id_rsa|\.aws|\.ssh|\.git-credentials|net1?\s+(user|group|localgroup)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)
| sort(@timestamp, order=desc)

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, event.type, tgt.process.cmdline, src.process.name, src.process.user

// HUNT: PHP2Shell web account discovery and credential file reads
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1033, T1082, T1016, T1552.001, T1083
// CONF: medium | FP: medium
// FALSE POSITIVES: monitoring or backup scripts run as the web account that call id, hostname or read config files
// EQUIVALENCE: equivalent-with-schema-assumptions - Same discovery and credential file command line patterns on Process Creation, limited to a web server or PHP worker creator or a web service account. Word boundaries and whitespace classes use bracket classes, slightly broader than the CQL.
// REQUIRES: SentinelOne Linux or Windows agent on the web server with Process Creation events
// TUNING: Exclude exact command lines from known monitoring and backup jobs per host. A web account reading id_rsa or cloud credential files has no routine reason and should not be excluded.
// LOOKBACK: 30d (set the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Credential files read by a built-in PHP function rather than a spawned command are not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' (src.process.name matches '^(php-fpm[0-9.]*|php-cgi[0-9.]*|lsphp[0-9]*|frankenphp|httpd|apache2|nginx|litespeed|lshttpd|w3wp)([.]exe)?$' or src.process.user matches '^(www-data|apache|nginx|php-fpm|httpd|nobody|wwwrun|www|lighttpd)$') tgt.process.cmdline matches 'whoami|uname[ ]+-[a-z]|(^|[ /;|])id[ ]*($|;|[|])|ifconfig|ipconfig|netstat|systeminfo|nltest|printenv|etc.passwd|etc.shadow|wp-config|[.]env([^a-z0-9_]|$)|settings\\.php|id_rsa|[.]aws|[.]ssh|[.]git-credentials|net1?[ ]+(user|group|localgroup)'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, ProcessCommandLine, InitiatingProcessFileName, AccountName
| take 5

// HUNT: PHP2Shell web account discovery and credential file reads
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1033, T1082, T1016, T1552.001, T1083
// CONF: medium | FP: medium
// FALSE POSITIVES: monitoring or backup scripts run as the web account that call id, hostname or read config files
// EQUIVALENCE: equivalent-with-schema-assumptions - Same discovery and credential file command line patterns on process creation, limited to a web server or PHP worker creator or a web service account. Word boundaries use bracket classes, slightly broader than the CQL. The regex is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents) on Linux or Windows web servers
// TUNING: Exclude exact command lines from known monitoring and backup jobs per host. A web account reading id_rsa or cloud credential files has no routine reason and should not be excluded.
// LOOKBACK: 30d (Advanced Hunting retention)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Credential files read by a built-in PHP function rather than a spawned command are not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where InitiatingProcessFileName matches regex @"(?i)^(php-fpm[0-9.]*|php-cgi[0-9.]*|lsphp[0-9]*|frankenphp|httpd|apache2|nginx|litespeed|lshttpd|w3wp)([.]exe)?$" or AccountName matches regex @"(?i)^(www-data|apache|nginx|php-fpm|httpd|nobody|wwwrun|www|lighttpd)$"
| where ProcessCommandLine matches regex @"(?i)whoami|uname[ ]+-[a-z]|(^|[ /;|])id[ ]*($|;|[|])|ifconfig|ipconfig|netstat|systeminfo|nltest|printenv|etc.passwd|etc.shadow|wp-config|[.]env([^a-z0-9_]|$)|settings\.php|id_rsa|[.]aws|[.]ssh|[.]git-credentials|net1?[ ]+(user|group|localgroup)"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: PHP2Shell web account persistence and account changes
// MITRE: T1053.003, T1053.005, T1098.004, T1136.001, T1543.002, T1548.003 | CONF: medium  FP: medium  COST: low
// REQUIRES: Falcon sensor on the web server; process creation with command line
// FALSE POSITIVES: deployment tooling run as the web account that edits cron or restarts services
// TUNING: allow-list exact deploy job command lines per host; never exclude useradd, chpasswd or authorized_keys writes by a web account
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| (ParentBaseFileName=/^(php-fpm[0-9.]*|php-cgi[0-9.]*|lsphp[0-9]*|frankenphp|httpd|apache2|nginx|litespeed|lshttpd|w3wp)(\.exe)?$/i or UserName=/^(www-data|apache|nginx|php-fpm|httpd|nobody|wwwrun|www|lighttpd)$/i)
| CommandLine=/crontab|authorized_keys|useradd|adduser|usermod|chpasswd|systemctl\s+(enable|daemon-reload)|\bat\s+-f|schtasks|net1?\s+(user|localgroup).*add|sudo\s+-[a-z]|\bsu\s+-/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)
| sort(@timestamp, order=desc)

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, event.type, tgt.process.cmdline, src.process.name, src.process.user

// HUNT: PHP2Shell web account persistence and account changes
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1053.003, T1053.005, T1098.004, T1136.001, T1543.002, T1548.003
// CONF: medium | FP: medium
// FALSE POSITIVES: deployment tooling run as the web account that edits cron or restarts services
// EQUIVALENCE: equivalent-with-schema-assumptions - Same persistence and account change command line patterns on Process Creation, limited to a web server or PHP worker creator or a web service account. Word boundaries and whitespace classes use bracket classes, slightly broader than the CQL.
// REQUIRES: SentinelOne Linux or Windows agent on the web server with Process Creation events
// TUNING: Allow-list exact deploy job command lines per host. Never exclude useradd, chpasswd or authorized_keys writes by a web account.
// LOOKBACK: 30d (set the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A persistence file written directly by PHP code without a spawned command is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' (src.process.name matches '^(php-fpm[0-9.]*|php-cgi[0-9.]*|lsphp[0-9]*|frankenphp|httpd|apache2|nginx|litespeed|lshttpd|w3wp)([.]exe)?$' or src.process.user matches '^(www-data|apache|nginx|php-fpm|httpd|nobody|wwwrun|www|lighttpd)$') tgt.process.cmdline matches 'crontab|authorized_keys|useradd|adduser|usermod|chpasswd|systemctl[ ]+(enable|daemon-reload)|(^|[ /;|])at[ ]+-f|schtasks|net1?[ ]+(user|localgroup).*add|sudo[ ]+-[a-z]|(^|[ /;|])su[ ]+-'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, ProcessCommandLine, InitiatingProcessFileName, AccountName
| take 5

// HUNT: PHP2Shell web account persistence and account changes
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1053.003, T1053.005, T1098.004, T1136.001, T1543.002, T1548.003
// CONF: medium | FP: medium
// FALSE POSITIVES: deployment tooling run as the web account that edits cron or restarts services
// EQUIVALENCE: equivalent-with-schema-assumptions - Same persistence and account change command line patterns on process creation, limited to a web server or PHP worker creator or a web service account. Word boundaries use bracket classes, slightly broader than the CQL. The regex is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents) on Linux or Windows web servers
// TUNING: Allow-list exact deploy job command lines per host. Never exclude useradd, chpasswd or authorized_keys writes by a web account.
// LOOKBACK: 30d (Advanced Hunting retention)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A persistence file written directly by PHP code without a spawned command is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where InitiatingProcessFileName matches regex @"(?i)^(php-fpm[0-9.]*|php-cgi[0-9.]*|lsphp[0-9]*|frankenphp|httpd|apache2|nginx|litespeed|lshttpd|w3wp)([.]exe)?$" or AccountName matches regex @"(?i)^(www-data|apache|nginx|php-fpm|httpd|nobody|wwwrun|www|lighttpd)$"
| where ProcessCommandLine matches regex @"(?i)crontab|authorized_keys|useradd|adduser|usermod|chpasswd|systemctl[ ]+(enable|daemon-reload)|(^|[ /;|])at[ ]+-f|schtasks|net1?[ ]+(user|localgroup).*add|sudo[ ]+-[a-z]|(^|[ /;|])su[ ]+-"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: PHP2Shell web account writes a PHP script or payload by command line
// MITRE: T1505.003, T1105, T1140, T1222.002 | CONF: medium  FP: medium  COST: low
// REQUIRES: Falcon sensor on the web server; process creation with command line (file creation of .php is not reliably logged, see coverage map)
// FALSE POSITIVES: deploy scripts, plugin or theme installers and package managers run as the web account
// TUNING: exclude exact deploy command lines during a change window; keep every write of .php, .phtml or .phar to an upload, cache or temp folder
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| (ParentBaseFileName=/^(php-fpm[0-9.]*|php-cgi[0-9.]*|lsphp[0-9]*|frankenphp|httpd|apache2|nginx|litespeed|lshttpd|w3wp)(\.exe)?$/i or UserName=/^(www-data|apache|nginx|php-fpm|httpd|nobody|wwwrun|www|lighttpd)$/i)
| CommandLine=/(>|tee\s+(-a\s+)?|\s-o\s*|\s-O\s*|of=)\s*\S*\.(php[0-9]?|phtml|phar|pht)\b|base64\s+(-d|--decode)|chmod\s+(\+x|[0-7]{3,4})\s+\S*(tmp|shm)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)
| sort(@timestamp, order=desc)

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, event.type, tgt.process.cmdline, src.process.name, src.process.user

// HUNT: PHP2Shell web account writes a PHP script or payload by command line
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1505.003, T1105, T1140, T1222.002
// CONF: medium | FP: medium
// FALSE POSITIVES: deploy scripts, plugin or theme installers and package managers run as the web account
// EQUIVALENCE: equivalent-with-schema-assumptions - Same command line patterns for writing a PHP script or payload, on Process Creation, limited to a web server or PHP worker creator or a web service account. Whitespace classes use bracket classes, slightly broader than the CQL.
// REQUIRES: SentinelOne Linux or Windows agent on the web server with Process Creation events
// TUNING: Exclude exact deploy command lines during a change window. Keep every write of .php, .phtml or .phar to an upload, cache or temp folder.
// LOOKBACK: 30d (set the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A script written by PHP code itself (file_put_contents) rather than a spawned command is not captured; see the file write card.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' (src.process.name matches '^(php-fpm[0-9.]*|php-cgi[0-9.]*|lsphp[0-9]*|frankenphp|httpd|apache2|nginx|litespeed|lshttpd|w3wp)([.]exe)?$' or src.process.user matches '^(www-data|apache|nginx|php-fpm|httpd|nobody|wwwrun|www|lighttpd)$') tgt.process.cmdline matches '(>|tee[ ]+(-a[ ]+)?|[ ]-o[ ]*|[ ]-O[ ]*|of=)[ ]*[^ ]*[.](php[0-9]?|phtml|phar|pht)([^a-z0-9_]|$)|base64[ ]+(-d|--decode)|chmod[ ]+([+]x|[0-7]{3,4})[ ]+[^ ]*(tmp|shm)'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, ProcessCommandLine, InitiatingProcessFileName, AccountName
| take 5

// HUNT: PHP2Shell web account writes a PHP script or payload by command line
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1505.003, T1105, T1140, T1222.002
// CONF: medium | FP: medium
// FALSE POSITIVES: deploy scripts, plugin or theme installers and package managers run as the web account
// EQUIVALENCE: equivalent-with-schema-assumptions - Same command line patterns for writing a PHP script or payload, on process creation, limited to a web server or PHP worker creator or a web service account. Whitespace classes use bracket classes, slightly broader than the CQL. The regex is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents) on Linux or Windows web servers
// TUNING: Exclude exact deploy command lines during a change window. Keep every write of .php, .phtml or .phar to an upload, cache or temp folder.
// LOOKBACK: 30d (Advanced Hunting retention)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A script written by PHP code itself (file_put_contents) rather than a spawned command is not captured; see the file write card.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where InitiatingProcessFileName matches regex @"(?i)^(php-fpm[0-9.]*|php-cgi[0-9.]*|lsphp[0-9]*|frankenphp|httpd|apache2|nginx|litespeed|lshttpd|w3wp)([.]exe)?$" or AccountName matches regex @"(?i)^(www-data|apache|nginx|php-fpm|httpd|nobody|wwwrun|www|lighttpd)$"
| where ProcessCommandLine matches regex @"(?i)(>|tee[ ]+(-a[ ]+)?|[ ]-o[ ]*|[ ]-O[ ]*|of=)[ ]*[^ ]*[.](php[0-9]?|phtml|phar|pht)([^a-z0-9_]|$)|base64[ ]+(-d|--decode)|chmod[ ]+([+]x|[0-7]{3,4})[ ]+[^ ]*(tmp|shm)"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: PHP2Shell executable written by a web server or PHP worker
// MITRE: T1105, T1505.003, T1204.002 | CONF: medium  FP: medium  COST: low
// REQUIRES: Falcon sensor on the web server; ElfFileWritten (Linux) or NewExecutableWritten and PeFileWritten (Windows). ⚠ validate in tenant that ContextBaseFileName is populated on these events
// FALSE POSITIVES: PECL or extension builds, application updaters and Composer plugins run through the web account
// TUNING: exclude known updater paths per host; keep writes under temp, shared-memory, upload and cache folders and anything the web account then executes
// LOOKBACK: 30d
#event_simpleName=/^(ElfFileWritten|NewExecutableWritten|PeFileWritten)$/
| ContextBaseFileName=/^(php-fpm[0-9.]*|php-cgi[0-9.]*|lsphp[0-9]*|frankenphp|httpd|apache2|litespeed|lshttpd|w3wp)(\.exe)?$/i
| table([@timestamp, ComputerName, #event_simpleName, ContextBaseFileName, TargetFileName, SHA256HashData], limit=200)
| sort(@timestamp, order=desc)

event.type = 'File Creation' src.process.name = * tgt.file.path = *
| limit 5
| columns event.time, event.type, src.process.name, tgt.file.path

// HUNT: PHP2Shell executable written by a web server or PHP worker
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1105, T1505.003, T1204.002
// CONF: medium | FP: medium
// FALSE POSITIVES: PECL or extension builds, application updaters and Composer plugins run through the web account
// EQUIVALENCE: approximate-analytic - The CQL keys on Falcon executable-written sensor events. SentinelOne File Creation events do not flag a file as executable, so this hunts file creation by a web server or PHP worker and keeps executable extensions and writes under temp and shared-memory folders. It can miss an extensionless binary dropped outside those folders and can add noise the CQL does not have.
// REQUIRES: SentinelOne Linux or Windows agent on the web server with File Creation events
// TUNING: Exclude known updater paths per host. Keep writes under temp, shared-memory, upload and cache folders and anything the web account then executes.
// LOOKBACK: 30d (set the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: An extensionless binary written outside temp and shared-memory folders is not captured. The nginx worker is left out, as in the CQL.
// VALIDATION LEVEL: static-reviewed
event.type = 'File Creation' src.process.name matches '^(php-fpm[0-9.]*|php-cgi[0-9.]*|lsphp[0-9]*|frankenphp|httpd|apache2|litespeed|lshttpd|w3wp)([.]exe)?$' tgt.file.path matches '[.](exe|dll|so|elf|bin|sh|scr|msi)$|^/(tmp|dev/shm|var/tmp)/'
| columns event.time, endpoint.name, src.process.name, tgt.file.path, tgt.file.sha256
| sort -event.time
| limit 200

DeviceFileEvents
| where Timestamp > ago(1d)
| project Timestamp, ActionType, InitiatingProcessFileName, FileName, FolderPath
| take 5

// HUNT: PHP2Shell executable written by a web server or PHP worker
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1105, T1505.003, T1204.002
// CONF: medium | FP: medium
// FALSE POSITIVES: PECL or extension builds, application updaters and Composer plugins run through the web account
// EQUIVALENCE: approximate-analytic - The CQL keys on Falcon executable-written sensor events. DeviceFileEvents does not flag a file as executable, so this hunts file creation by a web server or PHP worker and keeps executable extensions and writes under temp and shared-memory folders. It can miss an extensionless binary dropped outside those folders and can add noise the CQL does not have.
// REQUIRES: Defender for Endpoint file telemetry (DeviceFileEvents) on Linux or Windows web servers
// TUNING: Exclude known updater paths per host. Keep writes under temp, shared-memory, upload and cache folders and anything the web account then executes.
// LOOKBACK: 30d (Advanced Hunting retention)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: An extensionless binary written outside temp and shared-memory folders is not captured. The nginx worker is left out, as in the CQL.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceFileEvents
| where Timestamp >= ago(30d)
| where ActionType == "FileCreated"
| where InitiatingProcessFileName matches regex @"(?i)^(php-fpm[0-9.]*|php-cgi[0-9.]*|lsphp[0-9]*|frankenphp|httpd|apache2|litespeed|lshttpd|w3wp)([.]exe)?$"
| where FileName matches regex @"(?i)[.](exe|dll|so|elf|bin|sh|scr|msi)$" or FolderPath matches regex @"(?i)^/(tmp|dev/shm|var/tmp)"
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessFileName, FileName, FolderPath, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: PHP2Shell reported source IPs seen on a web server
// MITRE: T1190, T1071.001 | CONF: low  FP: medium  COST: low
// REQUIRES: Falcon sensor; NetworkConnectIP4 for outbound and NetworkReceiveAcceptIP4 for inbound (inbound coverage varies by sensor and OS, validate in tenant)
// FALSE POSITIVES: shared anonymization infrastructure used by unrelated traffic; Amazon says investigate rather than block
// TUNING: treat a hit as a lead; pivot to Q1, Q2 and Q3 on the same host and to web access logs (N2) for the request; do not block on this query alone
// LOOKBACK: 30d (first reported source activity 2026-10-17)
#event_simpleName=/^(NetworkConnectIP4|NetworkReceiveAcceptIP4)$/
| in(field=RemoteAddressIP4, values=["103.216.220.92", "31.223.184.166", "37.19.200.5", "134.209.159.64", "103.114.163.188", "95.217.98.37", "85.11.167.243", "45.198.224.169", "109.71.252.97"])
| table([@timestamp, ComputerName, #event_simpleName, ContextBaseFileName, LocalPort, RemoteAddressIP4, RemotePort], limit=200)
| sort(@timestamp, order=desc)

event.type = 'IP Connect' dst.ip.address = *
| limit 5
| columns event.time, event.type, dst.ip.address, src.ip.address

// HUNT: PHP2Shell reported source IPs seen on a web server
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1190, T1071.001
// CONF: low | FP: medium
// FALSE POSITIVES: shared anonymization infrastructure used by unrelated traffic; Amazon says investigate rather than block
// EQUIVALENCE: equivalent-with-schema-assumptions - Same indicator list matched against IP Connect events in either address position, which covers both the outbound and inbound halves of the CQL.
// REQUIRES: SentinelOne agent with IP Connect events; inbound coverage varies by agent and OS
// TUNING: Treat a hit as a lead. Pivot to Q1, Q2 and Q3 on the same host and to web access logs for the request. Do not block on this query alone.
// LOOKBACK: 30d (set the console time picker; first reported source activity 2026-10-17)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Inbound connections the agent does not log are not captured; the request itself is only visible in web access logs.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect' (dst.ip.address in ('103.216.220.92', '31.223.184.166', '37.19.200.5', '134.209.159.64', '103.114.163.188', '95.217.98.37', '85.11.167.243', '45.198.224.169', '109.71.252.97') or src.ip.address in ('103.216.220.92', '31.223.184.166', '37.19.200.5', '134.209.159.64', '103.114.163.188', '95.217.98.37', '85.11.167.243', '45.198.224.169', '109.71.252.97'))
| columns event.time, endpoint.name, event.network.direction, src.process.name, src.ip.address, src.port.number, dst.ip.address, dst.port.number
| sort -event.time
| limit 200

DeviceNetworkEvents
| where Timestamp > ago(1d)
| project Timestamp, RemoteIP, RemotePort
| take 5

// HUNT: PHP2Shell reported source IPs seen on a web server
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1190, T1071.001
// CONF: low | FP: medium
// FALSE POSITIVES: shared anonymization infrastructure used by unrelated traffic; Amazon says investigate rather than block
// EQUIVALENCE: equivalent-with-schema-assumptions - Same indicator list matched against the remote address of network events, which covers both the outbound and inbound halves of the CQL when the sensor logs inbound connections.
// REQUIRES: Defender for Endpoint network telemetry (DeviceNetworkEvents); inbound rows appear as InboundConnectionAccepted only where the sensor logs them
// TUNING: Treat a hit as a lead. Pivot to Q1, Q2 and Q3 on the same host and to web access logs for the request. Do not block on this query alone.
// LOOKBACK: 30d (Advanced Hunting retention; first reported source activity 2026-10-17)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Inbound connections the sensor does not log are not captured; the request itself is only visible in web access logs.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(30d)
| where RemoteIP in ("103.216.220.92", "31.223.184.166", "37.19.200.5", "134.209.159.64", "103.114.163.188", "95.217.98.37", "85.11.167.243", "45.198.224.169", "109.71.252.97")
| project Timestamp, ReportId, DeviceId, DeviceName, ActionType, InitiatingProcessFileName, LocalPort, RemoteIP, RemotePort
| sort by Timestamp desc
| take 200

// HUNT: PHP2Shell rare external destinations from PHP and web workers
// MITRE: T1071.001, T1105, T1041 | CONF: low  FP: medium  COST: medium
// REQUIRES: Falcon sensor on the web server; NetworkConnectIP4 with ContextBaseFileName populated
// FALSE POSITIVES: payment, mail, update, CDN and API calls made by the application
// TUNING: exclude your known service destinations (use cidr for ranges); keep destinations seen from one or two hosts and any new destination first seen after 2026-10-17
// LOOKBACK: 14d
#event_simpleName=NetworkConnectIP4
| ContextBaseFileName=/^(php-fpm[0-9.]*|php-cgi[0-9.]*|lsphp[0-9]*|frankenphp|httpd|apache2|litespeed|lshttpd|w3wp)(\.exe)?$/i
| !cidr(RemoteAddressIP4, subnet=["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8", "169.254.0.0/16"])
| groupBy([RemoteAddressIP4, RemotePort], function=[count(aid, distinct=true, as=hosts), count(as=conns), collect([ContextBaseFileName], limit=3)])
| sort(hosts, order=asc, limit=200)

event.type = 'IP Connect' src.process.name = * dst.ip.address = *
| limit 5
| columns event.type, src.process.name, dst.ip.address, dst.port.number, agent.uuid

// HUNT: PHP2Shell rare external destinations from PHP and web workers
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1071.001, T1105, T1041
// CONF: low | FP: medium
// FALSE POSITIVES: payment, mail, update, CDN and API calls made by the application
// EQUIVALENCE: equivalent-with-schema-assumptions - Same rarity analytic: external IP Connect destinations from web server and PHP worker processes, grouped by address and port and sorted by fewest distinct hosts first. Private, loopback and link-local ranges are excluded with the same five subnets as the CQL.
// REQUIRES: SentinelOne agent with IP Connect events and the acting process populated
// TUNING: Exclude your known service destinations. Keep destinations seen from one or two hosts and any new destination first seen after 2026-10-17.
// LOOKBACK: 14d (set the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The nginx worker is left out, as in the CQL. Only one process name per group is shown.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect' src.process.name matches '^(php-fpm[0-9.]*|php-cgi[0-9.]*|lsphp[0-9]*|frankenphp|httpd|apache2|litespeed|lshttpd|w3wp)([.]exe)?$' !(net_ipsubnet(dst.ip.address, '10.0.0.0/8') or net_ipsubnet(dst.ip.address, '172.16.0.0/12') or net_ipsubnet(dst.ip.address, '192.168.0.0/16') or net_ipsubnet(dst.ip.address, '127.0.0.0/8') or net_ipsubnet(dst.ip.address, '169.254.0.0/16'))
| group hosts=estimate_distinct(agent.uuid), conns=count(), process_name=any(src.process.name) by dst.ip.address, dst.port.number
| sort +hosts
| limit 200

DeviceNetworkEvents
| where Timestamp > ago(1d)
| project Timestamp, ActionType, InitiatingProcessFileName, RemoteIP, RemotePort, DeviceId
| take 5

// HUNT: PHP2Shell rare external destinations from PHP and web workers
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1071.001, T1105, T1041
// CONF: low | FP: medium
// FALSE POSITIVES: payment, mail, update, CDN and API calls made by the application
// EQUIVALENCE: equivalent-with-schema-assumptions - Same rarity analytic: external connections from web server and PHP worker processes, grouped by address and port and sorted by fewest distinct devices first. Private, loopback and link-local ranges are excluded with the same five subnets as the CQL.
// REQUIRES: Defender for Endpoint network telemetry (DeviceNetworkEvents) with the initiating process populated
// TUNING: Exclude your known service destinations. Keep destinations seen from one or two devices and any new destination first seen after 2026-10-17.
// LOOKBACK: 14d (Advanced Hunting retention allows up to 30d)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The nginx worker is left out, as in the CQL.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(14d)
| where ActionType == "ConnectionSuccess"
| where InitiatingProcessFileName matches regex @"(?i)^(php-fpm[0-9.]*|php-cgi[0-9.]*|lsphp[0-9]*|frankenphp|httpd|apache2|litespeed|lshttpd|w3wp)([.]exe)?$"
| where not(ipv4_is_in_any_range(RemoteIP, dynamic(["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8", "169.254.0.0/16"])))
| summarize hosts = dcount(DeviceId), conns = count(), processes = make_set(InitiatingProcessFileName, 3) by RemoteIP, RemotePort
| sort by hosts asc
| take 200

// HUNT: PHP2Shell upload-progress marker or scanner string on a command line
// MITRE: T1190, T1595.002 | CONF: low  FP: medium  COST: low
// REQUIRES: Falcon sensor; process creation with command line. This does NOT see HTTP request bodies; the exploit request itself is outside endpoint telemetry
// FALSE POSITIVES: authorized vulnerability scans, vendor check tools and internal lab validation of this flaw
// TUNING: exclude the scan hosts and service accounts you run on purpose; a hit on a production web server outside a change window warrants review of Q1 to Q3 on that host
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/PHP_SESSION_UPLOAD_PROGRESS|php2shell-scan/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)
| sort(@timestamp, order=desc)

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, event.type, tgt.process.cmdline

// HUNT: PHP2Shell upload-progress marker or scanner string on a command line
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1190, T1595.002
// CONF: low | FP: medium
// FALSE POSITIVES: authorized vulnerability scans, vendor check tools and internal lab validation of this flaw
// EQUIVALENCE: equivalent-with-schema-assumptions - Same two strings searched in the command line of Process Creation events. matches is case-insensitive by default, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne agent with Process Creation events. This does not see HTTP request bodies.
// TUNING: Exclude the scan hosts and service accounts you run on purpose. A hit on a production web server outside a change window warrants review of Q1 to Q3 on that host.
// LOOKBACK: 30d (set the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The exploit request itself is outside endpoint telemetry; only a command line that carries the strings is seen.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.cmdline matches 'PHP_SESSION_UPLOAD_PROGRESS|php2shell-scan'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, ProcessCommandLine
| take 5

// HUNT: PHP2Shell upload-progress marker or scanner string on a command line
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1190, T1595.002
// CONF: low | FP: medium
// FALSE POSITIVES: authorized vulnerability scans, vendor check tools and internal lab validation of this flaw
// EQUIVALENCE: equivalent-with-schema-assumptions - Same two strings searched in the command line of process creation events. contains is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents). This does not see HTTP request bodies.
// TUNING: Exclude the scan hosts and service accounts you run on purpose. A hit on a production web server outside a change window warrants review of Q1 to Q3 on that host.
// LOOKBACK: 30d (Advanced Hunting retention)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The exploit request itself is outside endpoint telemetry; only a command line that carries the strings is seen.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where ProcessCommandLine contains "PHP_SESSION_UPLOAD_PROGRESS" or ProcessCommandLine contains "php2shell-scan"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200