DFIR Diva

Yesterday, we promised free PHP2Shell hunting material. Today, we’ve created a Hunt Lead covering successful exploitation against a Linux system. Researcher analysis is normally subscriber-only. For this Hunt Lead, we’ve made the full analysis free to benefit the whole community. Here’s what you’ll get: • 14,838 normalized records covering EDR, auditd, Sysmon for Linux, authentication and system logs, plus Zeek HTTP, connection and file-analysis records. • 5 endpoint alerts and 145 Suricata records, with network rule matches distinguished from stream warnings. • 10 KQL hunting queries, 3 Sigma rules and 3 Suricata rules to review and adapt for your environment. • 5 investigation questions connecting the network activity with evidence from the host. • A downloadable PCAP and investigation guide so you can examine the exploitation traffic in Wireshark alongside the host evidence. The Hunt Lead also covers the vulnerabilities, affected versions and mitigation steps, with the information dated 22 October 2026. Linux is the first release. We haven’t seen a working Windows PoC or successful PHP2Shell exploitation against our Windows environments. So far, the Windows activity we’ve observed has been fingerprinting and reconnaissance. We’ll add verified Windows evidence to the same Hunt Lead when it becomes available. Investigate the lead, read the brief, inspect the findings, grab the Hunt pack and explore the detailed researcher analysis. Then use the queries and rules to start hunting in your own environment. All of it is free for everyone. threathuntinglabs.com/leads/…