https://nirmalunagar.com/tags/microsoft-defender/Recent content in Microsoft Defender on NirmalHugoenMon, 26 Oct 2026 00:00:00 +0530https://nirmalunagar.com/posts/php-to-shell-detections-mde/Mon, 26 Oct 2026 00:00:00 +0530https://nirmalunagar.com/posts/php-to-shell-detections-mde/<p>Hello Folks, I am Nirmal Unagar</p> <p>In this blog, I&rsquo;ll walk through a set of PHP webshell detections I built using Microsoft Defender for Endpoint (MDE) advanced hunting — no Sentinel involved. Before jumping into the queries, I want to cover some background on how PHP actually runs on a server, because understanding that makes the detections much easier to follow. I&rsquo;ll also call out where Windows and Linux differ, since a lot of PHP hosting runs on Linux and most public writeups only cover Windows/IIS.</p>https://nirmalunagar.com/posts/php2shell_detection_blog_all_explained/Mon, 26 Oct 2026 00:00:00 +0530https://nirmalunagar.com/posts/php2shell_detection_blog_all_explained/<p>Last couple of days I was working on how to detect PHP2SHELL using Defender XDR Advance hunting query so here is my POV, I&rsquo;ll walk through a set of PHP webshell detections I built using Microsoft Defender for Endpoint (MDE) advanced hunting — no Sentinel involved. Before jumping into the queries, I want to cover some background on how PHP actually runs on a server, because understanding that makes the detections much easier to follow. I&rsquo;ll also call out where Windows and Linux differ, since a lot of PHP hosting runs on Linux and most public writeups only cover Windows/IIS.</p>