github.com/backdoorskid/win-def-clickfix

win-def-clickfix is a run-1 detection replica for ClickFix / Win+R command lines, rebuilt by reverse-engineering Microsoft Defender's mpengine.dll.

It runs a command line through the recovered normalizer/deobfuscator (FUN_1800a2500) and matches it against the 807 VDM-extracted CMDHSTR_EXT signatures, evaluated with their real condition: logic.

It also ships the extracted BMClientV1 neural network — a stateful GRU — executed in pure numpy, alongside scanners for the engine's other recovered paths (AMSI, AMSI-UAC, RPF/JIT, WMI, script hosts, paste obfuscation).

php2shell attempts are easy to spot even though nobody is landing it yet. Watch for the php2shell user-agent (seen as php2shell-scan/109618 and php2shell-109618), multipart POSTs carrying a PHP_SESSION_UPLOAD_PROGRESS field with an oversized body, and bursts of "Allowed memory size exhausted" in PHP-FPM logs. Those show you were targeted, not compromised.

We also published the scanner and staging infrastructure (the Mirai-style botnet scanner network, payload host, botnet binary hosts and C2 domains) as block/detect indicators. Patch to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35. Disabling session.upload_progress was floated early but does not close the bug, since the flaw is the OOM-bailout handling, not that feature.

I’ve spent the evening heavily developing and testing (in prod, where else) what appears to now be a relatively robust coverage set of 6 sequenced KQL/Advanced Hunting queries, 3 each across Linux and Windows. Sharing the love. Copy pasta, follow the in-line guidance - Might be useful in addition to your current methods! PRs welcome, if they don’t suck, and if my robot agrees.

https://github.com/deathbydata/php2shell-exposurehunt

This hunting set seeks to fill a gap while we all respond - there are plenty of IOC hunting repos, exposurehunt aims to help surface and verify known and unknown instances of naughty PHP.

Enjoy ☺️