How deathbydata/php2shell-exposurehunt works
php2shell-exposurehunt is a set of Defender XDR Advanced Hunting queries for finding onboarded Windows and Linux devices with active PHP and assessing exposure to two PHP2Shell CVEs. Analysts run four hunts in order for each OS: identify PHP, inspect evidence and versions, check web-serving devices for missed evidence, then compare results with Defender Vulnerability Management. The README documents these capabilities and data sources; no query source excerpts were provided, so implementation-level calls and data flow beyond those documented are omitted.
Main entry points: windows/01-any-php.kql Windows PHP check · linux/01-any-php.kql Linux PHP check · windows/02-evidence-breakout.kql Windows evidence · linux/02-evidence-breakout.kql Linux evidence
Components 10
PHP detection
- Windows PHP check
queries/windows/01-any-php.kql - Linux PHP check
queries/linux/01-any-php.kql - Windows evidence
queries/windows/02-evidence-breakout.kql - Linux evidence
queries/linux/02-evidence-breakout.kql
Serving safety net
- Windows safety net
queries/windows/03-safety-net.kql - Linux safety net
queries/linux/03-safety-net.kql
CVE validation
- Windows CVE check
queries/windows/04-defender-cve-check.kql - Linux CVE check
queries/linux/04-defender-cve-check.kql
Other components
- Security analyst
- Defender XDR data
Connections 16
- Security analyst → Windows PHP check: runs first
README.md - Security analyst → Windows evidence: runs next
README.md - Security analyst → Windows safety net: runs next
README.md - Security analyst → Windows CVE check: runs last
README.md - Security analyst → Linux PHP check: runs first
README.md - Security analyst → Linux evidence: runs next
README.md - Security analyst → Linux safety net: runs next
README.md - Security analyst → Linux CVE check: runs last
README.md - Defender XDR data → Windows PHP check: provides endpoint data
README.md - Defender XDR data → Linux PHP check: provides endpoint data
README.md - Defender XDR data → Windows evidence: provides endpoint data
README.md - Defender XDR data → Linux evidence: provides endpoint data
README.md - Defender XDR data → Windows safety net: provides endpoint data
README.md - Defender XDR data → Linux safety net: provides endpoint data
README.md - Defender XDR data → Windows CVE check: provides CVE findings
README.md - Defender XDR data → Linux CVE check: provides CVE findings
README.md