Correction, Oct 25: Unit 42 retracted the Oct 23 update these queries came from and can no longer confirm the intrusion behind them involved PHP2Shell. The web-worker child-process hunt below is a generic web-shell detection and still worth running on unpatched PHP hosts; the ==SHELLUSER==/==PASSWD== markers came from that one withdrawn case and are not a confirmed PHP2Shell indicator. For PHP2Shell-specific hunting, see the other Threat Hunting items from Oct 20-22.

Unit 42's Oct 23 update adds managed threat hunting queries for PHP2Shell post-exploitation. They are not specific to these CVEs, so they also catch other web-app exploitation.

• Process lineage: any process started by a PHP web worker or its launcher (apache2, httpd, php-fpm*, php-cgi*, lsphp, litespeed, frankenphp, sw-engine), a shell directly under an IIS worker, or the web service account running commands outside an interactive login.
• Agent fingerprints: command lines that echo section headers such as ==SHELLUSER== or ==PASSWD== between commands, many short recon commands in tight sequence, and rapid retries with different tools after a failure.
• What they went after: password hash files, MFA secret stores, and outbound tunnels used for NTLM relay into Active Directory. Check web hosts for new outbound tunnels and DCs for NTLM authentications sourced from web servers, then look for Domain Admin group changes.
• Network side: inbound IPS hits from public IPs for PHP multipart, upload-progress or longjmp signatures (Palo Alto threat ID 543004) give you a list of hosts to triage first.
• Look back to Oct 17, the first exploit attempt Amazon reported.

If you find a hit, rotate MFA seeds and service-account passwords that the host could read, not just the local accounts.