id: e0d3171b-48a9-5604-b1e4-653cc3e65f55
name: PHP2Shell - PHP memory fatal at request startup
description: |
  'A web server logged a PHP memory-exhaustion fatal error raised "in Unknown on line 0", before any script ran: the trace CrowdStrike describes for attempts on CVE-2026-109618. Needs web server error logs in Syslog.'
severity: Medium
requiredDataConnectors:
  - connectorId: SyslogAma
    dataTypes:
      - Syslog
queryFrequency: 15m
queryPeriod: 15m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1190
query: |
  // PHP2Shell (CVE-2026-109618): a memory fatal raised while the request starts, before any application code runs.
  // Ordinary script memory errors name a file and a line; these name "Unknown" and line 0.
  Syslog
  | where SyslogMessage has "Allowed memory size" and SyslogMessage contains "in Unknown on line 0"
  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), Events = count(), Sample = take_any(SyslogMessage) by Computer, ProcessName
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: Computer
eventGroupingSettings:
  aggregationKind: AlertPerResult
version: 1.0.0
kind: Scheduled