# deathbydata/php2shell-exposurehunt architecture

> Architecture diagram of the GitHub repository deathbydata/php2shell-exposurehunt, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-13). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/deathbydata/php2shell-exposurehunt
- Repository: https://github.com/deathbydata/php2shell-exposurehunt

## Overview

php2shell-exposurehunt is a set of Defender XDR Advanced Hunting queries for finding onboarded Windows and Linux devices with active PHP and assessing exposure to two PHP2Shell CVEs. Analysts run four hunts in order for each OS: identify PHP, inspect evidence and versions, check web-serving devices for missed evidence, then compare results with Defender Vulnerability Management. The README documents these capabilities and data sources; no query source excerpts were provided, so implementation-level calls and data flow beyond those documented are omitted.

Main entry points: [`queries/windows/01-any-php.kql`](https://github.com/deathbydata/php2shell-exposurehunt/blob/main/queries/windows/01-any-php.kql) (Windows PHP check), [`queries/linux/01-any-php.kql`](https://github.com/deathbydata/php2shell-exposurehunt/blob/main/queries/linux/01-any-php.kql) (Linux PHP check), [`queries/windows/02-evidence-breakout.kql`](https://github.com/deathbydata/php2shell-exposurehunt/blob/main/queries/windows/02-evidence-breakout.kql) (Windows evidence), [`queries/linux/02-evidence-breakout.kql`](https://github.com/deathbydata/php2shell-exposurehunt/blob/main/queries/linux/02-evidence-breakout.kql) (Linux evidence)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_detection["PHP detection"]
  node_windows1["Windows PHP check<br/>[01-any-php.kql]"]
  node_linux1["Linux PHP check<br/>[01-any-php.kql]"]
  node_windows2["Windows evidence"]
  node_linux2["Linux evidence"]
end

subgraph group_safety["Serving safety net"]
  node_windows3["Windows safety net<br/>[03-safety-net.kql]"]
  node_linux3["Linux safety net<br/>[03-safety-net.kql]"]
end

subgraph group_validation["CVE validation"]
  node_windows4["Windows CVE check"]
  node_linux4["Linux CVE check"]
end

node_analyst(("Security analyst"))
node_defender[("Defender XDR data")]

node_analyst -->|"runs first"| node_windows1
node_analyst -->|"runs next"| node_windows2
node_analyst -->|"runs next"| node_windows3
node_analyst -->|"runs last"| node_windows4
node_analyst -->|"runs first"| node_linux1
node_analyst -->|"runs next"| node_linux2
node_analyst -->|"runs next"| node_linux3
node_analyst -->|"runs last"| node_linux4
node_defender -->|"provides endpoint data"| node_windows1
node_defender -->|"provides endpoint data"| node_linux1
node_defender -->|"provides endpoint data"| node_windows2
node_defender -->|"provides endpoint data"| node_linux2
node_defender -->|"provides endpoint data"| node_windows3
node_defender -->|"provides endpoint data"| node_linux3
node_defender -->|"provides CVE findings"| node_windows4
node_defender -->|"provides CVE findings"| node_linux4

click node_windows1 "https://github.com/deathbydata/php2shell-exposurehunt/blob/main/queries/windows/01-any-php.kql"
click node_linux1 "https://github.com/deathbydata/php2shell-exposurehunt/blob/main/queries/linux/01-any-php.kql"
click node_windows2 "https://github.com/deathbydata/php2shell-exposurehunt/blob/main/queries/windows/02-evidence-breakout.kql"
click node_linux2 "https://github.com/deathbydata/php2shell-exposurehunt/blob/main/queries/linux/02-evidence-breakout.kql"
click node_windows3 "https://github.com/deathbydata/php2shell-exposurehunt/blob/main/queries/windows/03-safety-net.kql"
click node_linux3 "https://github.com/deathbydata/php2shell-exposurehunt/blob/main/queries/linux/03-safety-net.kql"
click node_windows4 "https://github.com/deathbydata/php2shell-exposurehunt/blob/main/queries/windows/04-defender-cve-check.kql"
click node_linux4 "https://github.com/deathbydata/php2shell-exposurehunt/blob/main/queries/linux/04-defender-cve-check.kql"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_windows1,node_linux1,node_windows2,node_linux2 toneBlue
class node_windows3,node_linux3,node_defender toneAmber
class node_windows4,node_linux4 toneMint
class node_analyst toneIndigo
```

## Components

### PHP detection

- [Windows PHP check](https://github.com/deathbydata/php2shell-exposurehunt/blob/main/queries/windows/01-any-php.kql): `queries/windows/01-any-php.kql`
- [Linux PHP check](https://github.com/deathbydata/php2shell-exposurehunt/blob/main/queries/linux/01-any-php.kql): `queries/linux/01-any-php.kql`
- [Windows evidence](https://github.com/deathbydata/php2shell-exposurehunt/blob/main/queries/windows/02-evidence-breakout.kql): `queries/windows/02-evidence-breakout.kql`
- [Linux evidence](https://github.com/deathbydata/php2shell-exposurehunt/blob/main/queries/linux/02-evidence-breakout.kql): `queries/linux/02-evidence-breakout.kql`

### Serving safety net

- [Windows safety net](https://github.com/deathbydata/php2shell-exposurehunt/blob/main/queries/windows/03-safety-net.kql): `queries/windows/03-safety-net.kql`
- [Linux safety net](https://github.com/deathbydata/php2shell-exposurehunt/blob/main/queries/linux/03-safety-net.kql): `queries/linux/03-safety-net.kql`

### CVE validation

- [Windows CVE check](https://github.com/deathbydata/php2shell-exposurehunt/blob/main/queries/windows/04-defender-cve-check.kql): `queries/windows/04-defender-cve-check.kql`
- [Linux CVE check](https://github.com/deathbydata/php2shell-exposurehunt/blob/main/queries/linux/04-defender-cve-check.kql): `queries/linux/04-defender-cve-check.kql`

### Other components

- **Security analyst**
- **Defender XDR data**

## Connections

- Security analyst → Windows PHP check: runs first (evidence: `README.md`)
- Security analyst → Windows evidence: runs next (evidence: `README.md`)
- Security analyst → Windows safety net: runs next (evidence: `README.md`)
- Security analyst → Windows CVE check: runs last (evidence: `README.md`)
- Security analyst → Linux PHP check: runs first (evidence: `README.md`)
- Security analyst → Linux evidence: runs next (evidence: `README.md`)
- Security analyst → Linux safety net: runs next (evidence: `README.md`)
- Security analyst → Linux CVE check: runs last (evidence: `README.md`)
- Defender XDR data → Windows PHP check: provides endpoint data (evidence: `README.md`)
- Defender XDR data → Linux PHP check: provides endpoint data (evidence: `README.md`)
- Defender XDR data → Windows evidence: provides endpoint data (evidence: `README.md`)
- Defender XDR data → Linux evidence: provides endpoint data (evidence: `README.md`)
- Defender XDR data → Windows safety net: provides endpoint data (evidence: `README.md`)
- Defender XDR data → Linux safety net: provides endpoint data (evidence: `README.md`)
- Defender XDR data → Windows CVE check: provides CVE findings (evidence: `README.md`)
- Defender XDR data → Linux CVE check: provides CVE findings (evidence: `README.md`)