Weekly detection rule digest covers 57 new rules and 93 updates across 10 repositories, with major themes spanning PHP2Shell exploitation, AI agent threats, phishing service abuse, BYOVD evasion, and credential persistence. Key findings: - PHP2Shell (CVE-2026-109618 and CVE-2026-109619) drew the most coordinated engineering effort this cycle. Splunk rules correlate multipart/form-data POST requests with PHP memory exhaustion errors across Apache and Nginx logs, matching on process ID, host, and client IP. Cisco Secure Firewall rules flag Signature ID 67359 for serialized input patterns and Signature ID 67360 for PHP session upload activity, with a correlated rule tying memory disclosure to exploitation attempts within a 5-minute window. KQL queries from SlimKQL and Sergio-Albea-Git inventory internet-exposed php-cgi.exe processes by joining DeviceInfo exposure state, DeviceTvmSoftwareInventory, and DeviceProcessEvents in Defender XDR, and alert when web servers or PHP binaries spawn interactive shells. The SlimKQL/Hunting-Queries-Detection-Rules repo adds a 30-day DeviceNetworkEvents hunt for accepted inbound connections from known php2Shell scanner IPs. - Generative AI and Model Context Protocol (MCP) threats have a growing detection footprint. Agent-Threat-Rule rules flag MCP stdio server config blocks setting NODE_OPTIONS, LD_PRELOAD, DYLD_INSERT_LIBRARIES, and BASH_ENV environment variables for process hijacking (CVE-2026-44995), and detect covert base64-encoded URL exfiltration to huggingface[.]co (CVE-2026-54316). SlimKQL Sentinel queries correlate Entra ID Privileged Identity Management records to flag locally running AI agents controlled by privileged accounts. KQL rules from davidalonsod parse AppRequests, AppDependencies, CustomAgentSpans, and AppGenAIContent in Azure Application Insights to normalize prompt and tool execution telemetry against watchlists for unapproved MCP targets. - Phishing rule updates in sublime-security/sublime-rules focus on trusted-service abuse and header manipulation. New and modified rules cover malicious links through Microsoft messaging infrastructure routed via Cloudflare Turnstile, Google security alert notifications with embedded URLs in app password fields, Zoho meeting callback scams, Power BI document lures, and SharePoint folder shares with lone .url files. Social engineering coverage adds Teams voice phishing alerts enriched with call metadata and Teams QR code impersonation delivery. DMARC authentication is now enforced on brand impersonation exclusions for GitHub, Meta, Chase Bank, Bank of America, Wells Fargo, Outlook, and Barracuda Networks, closing a bypass where spoofed legitimate root domains evaded detection. - LOLDrivers shifted BYOVD detection from IMPHASH to explicit MD5, SHA1, and SHA256 hashes to reduce false positives in driver load monitoring. Filename-based detections were downgraded to low severity and repositioned as hunting telemetry, with noisy entries like kavservice.bin removed. Splunk added renamed binary detection comparing running process names against internal OriginalFileName metadata in process creation telemetry, covering mshta.exe, hh.exe, MSBuild.exe, regsvr32.exe, PowerShell, PsExec, WinRAR, 7-Zip, and rclone. - Credential and persistence detections got meaningful depth. The alexverboon LAPS queries correlate Entra ID audit log password retrievals with local RID 500 administrator logons on the target host within a four-hour window, useful for hunting lateral movement following LAPS abuse. Splunk added Sysmon Event ID 20 for WMI Event Consumer creation and Microsoft-Windows-WMI-Activity EventCode 5860 for temporary WMI event subscriptions. Neo23x0/signature-base received 53 YARA updates covering APT37 BLUELIGHT, APT41 POISONPLUG and CRACKSHOT, Turla Gazer, APT28 Downrage, OilRig VBS, Equation Group noclient and teflondoor, WCE and Pass-the-Hash Toolkit binaries, and Impacket mmcexec. Practitioner takeaway: for teams running Defender XDR, the php2Shell hunt joining DeviceInfo, DeviceTvmSoftwareInventory, and DeviceNetworkEvents is the highest-priority pull this week given active exploitation interest in CVE-2026-109618 and CVE-2026-109619. For detection engineers reviewing PRs, the three new static checks (Q0105 for unintended YAML escape sequences, Q0106 for wildcards passed to exact-match operators, and Q0216 for contradictory numeric predicates) address silent rule failures that produce dead coverage with no runtime error. Rules, queries, and YARA signatures are in the linked repositories across splunk/security_content, sublime-security/sublime-rules, magicsword-io/LOLDrivers, Neo23x0/signature-base, SlimKQL/Detections.AI, and alexverboon/Hunting-Queries-Detection-Rules. #DFIR_Radar
Post summary
The weekly digest highlights extensive detection rule updates across multiple repositories, with a focus on active exploitation of PHP2Shell CVE‑2026‑109618/109619 and detailed technical coverage of related threats such as MCP hijacking and phishing abuse, plus new static checks for rule reliability.
