KQL Search

Query Details

Successful Php2shell Indicator Scan

Query

let IOC = dynamic([
"2.59.133.151",
"185.65.134.250",
"185.184.222.160",
"206.245.153.56",
"23.234.81.67"
]);
DeviceNetworkEvents
| where Timestamp > ago(30d)
| where ActionType == "InboundConnectionAccepted"
| where RemoteIP has_any(IOC)

Explanation

This KQL (Kusto Query Language) query is designed to search for specific network events in a dataset called DeviceNetworkEvents. Here's a simple breakdown of what it does:

  1. Define a List of IPs: It starts by creating a list of IP addresses, referred to as IOC (Indicators of Compromise). These are the IPs you are interested in monitoring.

  2. Filter by Time: The query looks at events that have occurred in the last 30 days (Timestamp > ago(30d)).

  3. Filter by Action Type: It specifically focuses on events where an inbound connection was accepted (ActionType == "InboundConnectionAccepted").

  4. Check for Specific IPs: Finally, it filters the results to only include events where the RemoteIP matches any of the IPs in the IOC list.

In summary, this query retrieves records of accepted inbound connections from the last 30 days that involve any of the specified IP addresses.