After reviewing the "evidence" of exploitation of #PHP2Shell and finding it wanting, we have removed the "EITW" tag from our story.
Our standard for "exploited in the wild" is not sprays against targets. It is direct observables from successful exploitation. That's a higher bar to clear, but for such a scary vulnerability, hardly impossible. So far however, we have not seen that level of evidence.
@ifin@infosec.exchange Thanks, I was wondering about this. A lot of security organisations saying attacks have been attempted but no information as to whether said attacks were successful
@ifin@infosec.exchange My corporate pen tester ran the exploit against clones of servers and purple team analyzed the telemetry and here are the IOCs we've settled on:
IOCs
We have found no evidence of compromise with these (other than the pen test) so we have no evidence of exploitation in the wild, but posting nonetheless in case there is something other's can use.
@ifin@infosec.exchange with the breadth of vulnerable systems and utilization of the vulnerability by many different actors, I wonder how transferable exploitation evidence will be? Especially for post exploitation activity (which for systems with terrible logging will likely be the only findable evidence) 🤔