Skip to main content

Execute Script - PHP2Shell Vulnerability - Audit

Summary​

This monitor executes the PHP2Shell Vulnerability - Audit script against online Windows computers that have not been audited in the past 7 days. It runs every hour and detects computers that meet all of the following conditions:

  • The operating system is Windows 10, Windows 11, or Windows Server 2016 or later.
  • The agent has checked in within the past 15 minutes.
  • The computer has no audit data in pvl_php2shell_vulnerability_audit from the past 7 days.
  • The script has not already run on the computer in the past 7 days.

As a result, each computer is audited about once every 7 days.

Dependencies​

Target​

Global

Alert Template​

  • △ Custom - Execute Script - PHP2Shell Vulnerability - Audit

Changelog​

2026-10-23​

  • Initial version of the document.