Detections Digest #20261026 roundup: 45 new rules and 50 updates across 10 repositories this week, covering PHP2Shell exploitation, AI agent abuse, BYOVD, Golden dMSA attacks, and evasive email infrastructure. Key findings: - PHP2Shell (CVE-2026-109618 and CVE-2026-109619) gets layered coverage in splunk/security_content. Zeek rules flag multipart POST requests abusing PHP_SESSION_UPLOAD_PROGRESS to inject serialized PHP objects or PHP tags in filename headers. Splunk correlates Apache and Nginx logs for memory exhaustion faults and POST bodies 1MB or larger returning HTTP 500. A separate process rule catches inline PHP execution via -r, --run, and -s switches across standard interpreters, phpdbg, and FrankenPHP without a file being written to disk. Parent process coverage for webshell spawning rules also now includes caddy, frankenphp, roadrunner, lighttpd, and iisexpress. - SigmaHQ/sigma adds end-to-end Defendnot coverage, targeting a hacktool that disables Windows Defender through undocumented Windows Security Center APIs. Detections span PowerShell download cradles, binary execution by import hash, registry tampering against Security Center AV provider keys, and scheduled task creation via Event IDs 4698 and 4702. Golden dMSA attack detection covers Event ID 4662 reads on msDS-DelegatedManagedServiceAccount and msKds-ProvRootKey objects, Event ID 4771 Kerberos pre-auth failures with codes 0x18 and 0x19 on machine accounts, and GoldenDMSA tool execution by command-line pattern. LSASS access rules drop the SYNCHRONIZE mask (0x100000) to cut EDR-generated noise while keeping credential dumping visibility. - AI agent and LLM threat rules expand significantly. Agent-Threat-Rule/agent-threat-rules adds detection for zero-width, soft-hyphen, and bidirectional Unicode control characters in MCP tool descriptions and SKILL[.]md files, mapped to MITRE ATLAS AML.T0051.001. SSRF logic now covers apex loopback wildcard domains, IPv4-mapped IPv6 subnets, internal-only domains (.internal, .local, .lan), and non-HTTP protocols including file, gopher, dict, ldap, and tftp. CVEs tracked across these rules include CVE-2025-68143, CVE-2025-68144, CVE-2026-0628, CVE-2026-55096, CVE-2019-5418, and CVE-2021-21311. Sublime-security adds prompt injection rules for calendar invites (.ics), invisible HTML Unicode sequences, and plain email bodies. - LOLRMM adds Sigma coverage for Ping32 (registry, process, network to cloud.nsecsoft[.]com, and file artifacts) and rogue VS Code Remote Tunnels with code-insiders.exe placed under C:\Windows\debug and outbound connections to global.rel.tunnels.api.visualstudio[.]com. LOLDrivers refreshes MD5, SHA1, SHA256, and IMPHASH lists for BYOVD rules covering both malicious and vulnerable driver loads, including environments with HVCI enabled. - The digest's engineering tip is worth operationalizing: defanged literals copied from threat reports into live query strings fail silently because they never match raw telemetry. The RuleCheck checks Q0700, Q0710-Q0713, Q0721, and Q0722 codify validation for IP and CIDR syntax, cloud IP overlap across AWS, Azure, GCP, and Cloudflare, hash format, and defanged value detection. If your team maintains an internal detection repository, run these checks before your next rule deployment, and audit existing rules for the SYNCHRONIZE mask noise pattern the LSASS updates address this week. #DFIR_Radar