🚀 Key Highlights
🐘 PHP2Shell Detection Coverage Expansion (CVE-2026-109618, CVE-2026-109619) 🐘
Expanded the PHP2Shell analytic story with new Linux auditd analytics for inline PHP code execution and web or application servers spawning shells. A new analytic correlates Apache segmentation-fault errors with multipart POST requests handled by the same worker process. This links crafted-request crashes to the requests that caused them. Refinements to the PHP memory exhaustion and serialized PHP upload-filename analytics improve entity mapping and accuracy. Together they connect request-level exploitation attempts to the crashes and shell activity that can follow.
🐚 Node2Shell Detection Coverage (CVE-2026-111497) 🐚
Introduced a new analytic story for Node2Shell, an out-of-bounds write in the Node.js Brotli decoder. New auditd analytics identify Linux processes that change their image under the same PID and bursts of service crashes and restarts. The updated large HTTP POST analytic now also surfaces requests that trigger server errors. Together these give defenders web and endpoint signals to investigate suspected exploitation and command execution.
🐧 Linux Auditd Behavioral Coverage 🐧
Added new analytics for raw socket creation from user-writable paths and compiled C source written to temporary directories. These improve visibility into post-exploitation tooling and staging on Linux hosts.
☁️ Azure AD Identity Abuse Coverage ☁️
Added new analytics for federated identity credentials added to service principals, guest users changed to members, suspicious device registrations, and Temporary Access Pass creation. These help defenders spot persistence and unauthorized access paths in Azure AD tenants.
🪟 Windows Execution and Persistence Detections 🪟
Introduced detections for scheduled task XML built through console echo commands, user-profile binaries terminating processes via taskkill, and Chromium sessions restored with the crash bubble suppressed. These improve visibility into defense evasion, persistence, and suspicious execution on Windows endpoints.
🎯 Refined Analytics for Fidelity and Coverage 🎯
Updated existing analytics for HTTP C2 user agents, React and Next.js child processes, ngrok reverse proxy usage (fixing a duplicate pattern), non-shell command-line tool execution, and Windows Remote Management spawned processes. The changes improve detection fidelity and broaden coverage of web exploitation, tunneling, and remote execution activity.
New Analytic Story - [1]
New Analytics - [14]
- Azure AD Federated Identity Credential Added To Service Principal
- Azure AD Guest User Type Changed To Member
- Azure AD Suspicious Device Registration
- Azure AD Temporary Access Pass Created
- Linux Auditd Inline PHP Code Execution
- Linux Auditd Process Image Change Under Same PID
- Linux Auditd SOCK RAW EAFNOSUPPORT From User Writable Path
- Linux Auditd Service Crash and Restart Burst
- Linux Auditd Web or Application Server Spawning a Shell
- Linux Compiled C Source To Tmp
- PHP Worker Segmentation Fault After Multipart POST
- Windows Chromium Session Restored With Crash Bubble Suppressed
- Windows Scheduled Task XML Built Via Console Echo
- Windows User Profile Binary Terminating Process Via Taskkill
Updated Analytics - [9]
- HTTP C2 Framework User Agent
- Large HTTP POST Request Resulting in Server Error
- Linux Ngrok Reverse Proxy Usage
- Linux Suspicious React or Next.js Child Process
- PHP Memory Exhaustion Exploitation Attempt via Multipart Request
- Serialized PHP Token in Upload Filename - Suricata
- Web or Application Server Spawning a Shell
- Windows Cmdline Tool Execution From Non-Shell Process
- Windows Remote Management Execute Shell
Other Updates
- A special thanks to @descambiado, @mvanhorn, @jakeenea51 and @thegreatmhn from the Security Content community for their contributions to this release, helping improve the quality and reliability of ESCU content.
- Fields and example logs were updated for 188 different data sources.
Content Removed in Release v6.10.0
As previously communicated in ESCU v6.8.0, ESCU v6.10.0 removes several detections. See the list of removed detections below for affected detections and recommended replacements. If you are currently using any deprecated detections, review the deprecated analytics in ESCU documentation for guidance on identifying, reviewing, and preserving deprecated detections before upgrading.
| Content | Content Type | Reason | Replacement Content |
|---|---|---|---|
| Child Processes of Spoolsv exe | Detection | Deprecated because the broad parent-child logic generated substantial legitimate printer, driver, and print-management activity and did not directly detect the exploitation behavior associated with its CVE reference. More specific Print Spooler behaviors are covered by existing production detections. | None |
| Detect HTML Help Renamed | Detection | Detection deprecated due to having a duplicated content with another detection. Renaming of all LOLBAS binaries are covered in a single detection instead of having their separate searches, for performance related reasons. | Windows Renamed LOLBAS Binary was Executed |
| Detect Renamed 7-Zip | Detection | Detection deprecated due to having a duplicated content with another detection. Renaming of all popular 3rd party software binaries are covered in a single detection instead of having their separate searches, for performance related reasons. | Windows Renamed Popular 3rd Party Software was Executed |
| Detect Renamed PSExec | Detection | Detection deprecated due to having a duplicated content with another detection. Renaming of all command interpreter binaries are covered in a single detection instead of having their separate searches, for performance related reasons. | Windows Renamed Command Interpreter was Executed |
| Detect Renamed RClone | Detection | Detection deprecated due to having a duplicated content with another detection. Renaming of all popular 3rd party software binaries are covered in a single detection instead of having their separate searches, for performance related reasons. | Windows Renamed Popular 3rd Party Software was Executed |
| Detect Renamed WinRAR | Detection | Detection deprecated due to having a duplicated content with another detection. Renaming of all popular 3rd party software binaries are covered in a single detection instead of having their separate searches, for performance related reasons. | Windows Renamed Popular 3rd Party Software was Executed |
| Detect WMI Event Subscription Persistence | Detection | This rule uses only Sysmon EventID 20, which records creation of a WMI event consumer but does not confirm that a filter is bound to it. The Sysmon permanent subscription detection covers the binding with EventID 21. | WMI Permanent Event Subscription - Sysmon |
| Detect mshta renamed | Detection | Detection deprecated due to having a duplicated content with another detection. Renaming of all LOLBAS binaries are covered in a single detection instead of having their separate searches, for performance related reasons. | Windows Renamed LOLBAS Binary was Executed |
| MacOS - Re-opened Applications | Detection | Detection deprecated as it is targeting a method of persistence that has been disabled in MacOS for years. As well, as the fact that the detection has been set to experimental since 2020. | None |
| Suspicious MSBuild Rename | Detection | Detection deprecated due to having a duplicated content with another detection. Renaming of all LOLBAS binaries are covered in a single detection instead of having their separate searches, for performance related reasons. | Windows Renamed LOLBAS Binary was Executed |
| Suspicious microsoft workflow compiler rename | Detection | Detection deprecated due to having a duplicated content with another detection. Renaming of all LOLBAS binaries are covered in a single detection instead of having their separate searches, for performance related reasons. | Windows Renamed LOLBAS Binary was Executed |
| WMI Temporary Event Subscription | Detection | This rule is deprecated in its current form because EventID 5860 identifies temporary subscriptions rather than permanent persistence, and the broad match with exact query-string exceptions does not reliably distinguish malicious use from legitimate software. Temporary WMI activity may warrant a separate behavior-focused detection. | None |
| Windows LOLBAS Executed As Renamed File | Detection | Detection deprecated due to renaming of its newer version. | Windows Renamed LOLBAS Binary was Executed |
| Windows Process Injection into Notepad | Detection | Detection deprecated as it is already covered by the" Windows Process Injection into Commonly Abused Processes" detection. | Windows Process Injection into Commonly Abused Processes |
| Windows Regsvr32 Renamed Binary | Detection | Detection deprecated due to having a duplicated content with another detection. Renaming of all LOLBAS binaries are covered in a single detection instead of having their separate searches, for performance related reasons. | Windows Renamed LOLBAS Binary was Executed |
| Windows Renamed Powershell Execution | Detection | Detection deprecated due to having a duplicated content with another detection. Renaming of all command interpreter binaries are covered in a single detection instead of having their separate searches, for performance related reasons. | Windows Renamed Command Interpreter was Executed |
| XMRIG Driver Loaded | Detection | Detection deprecated as it is inaccurate. WinRing0x64.sys is not related to XMRIG. It is a driver that is used to access the hardware ring0. | Windows Vulnerable Driver Installed, Windows Vulnerable Driver Loaded |
Content Scheduled for Removal in Future Releases
The follow detections are deprecated and will be removed in ESCU 6.12.0.
| Content | Content Type | Removed in Version | Reason | Replacement Content |
|---|---|---|---|---|
| Circle CI Disable Security Job | Detection | 6.12.0 | Detection deprecated because the Technology Add-on it uses has been archived, and no replacement TA exists. | None |
| Circle CI Disable Security Step | Detection | 6.12.0 | Detection deprecated because the Technology Add-on it uses has been archived, and no replacement TA exists. | None |
| Detect Large ICMP Traffic | Detection | 6.12.0 | Detection deprecated as it is determined to be very noisy in a production environment. | None |
| Detection of tools built by NirSoft | Detection | 6.12.0 | Detection deprecated due to duplicated content already covered by other detections. | Windows NirSoft Utilities |
| Ollama Abnormal Service Crash Availability Attack | Detection | 6.12.0 | This experimental rule is being deprecated while we enhance Ollama availability detection. Application errors alone do not confirm a service outage, so we are improving the evidence needed to identify service interruptions reliably. | Ollama Repeated Application Errors |
| Ollama Possible Model Exfiltration Data Leakage | Detection | 6.12.0 | This experimental rule is being deprecated while we enhance Ollama exfiltration detection. Access requests and response timing alone do not show what data was returned or transferred, so stronger evidence and correlation are needed. | None |
| Ollama Possible RCE via Model Loading | Detection | 6.12.0 | This experimental rule is being deprecated while we enhance Ollama model-loading detection. Model-loading errors alone do not confirm code execution, so the detection needs stronger evidence of execution. | None |
| Ollama Suspicious Prompt Injection Jailbreak | Detection | 6.12.0 | This experimental rule is being deprecated while we enhance Ollama prompt-injection detection. Long response times do not reveal prompt content or show that safeguards were bypassed, so they are not enough to identify these attacks reliably. | Ollama Long-Running Inference Requests |
| Possible Browser Pass View Parameter | Detection | 6.12.0 | Detection deprecated due to duplicated content already covered by other detections. | Windows NirSoft Utilities |
| WinRM Spawning a Process | Detection | 6.12.0 | Detection deprecated because its parent and child process selection is covered by the expanded Windows Remote Management Execute Shell detection. The non shell processes were not transferred to the new detection due to scope considerations, and the fact that this detection was experimental, so any claims made by it were not validated via testing. | Windows Remote Management Execute Shell |
| Windows NirSoft AdvancedRun | Detection | 6.12.0 | Detection deprecated due to duplicated content already covered by other detections. | Windows NirSoft Utilities |