https://signal-desk-d5t.pages.devExploited-now security news, threat hunting, AI security and practical playbooks.https://signal-desk-d5t.pages.dev/hunting#hunt-ahsayhttps://signal-desk-d5t.pages.dev/hunting#hunt-ahsayTue, 13 Oct 2026 00:00:00 +0000hunt ideaBoth campaigns end in web-server-spawned shells and miners. Look for the web service process spawning cmd/powershell/sh, new script files in web roots, and outbound connections to mining pools.<pre>// KQL (Defender) sketch DeviceProcessEvents | where InitiatingProcessFileName in~ ("java.exe","w3wp.exe","httpd","php-fpm") | where FileName in~ ("cmd.exe","powershell.exe","sh","bash") | project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLine</pre>Tune the parent list to your stack. Sketch only; validate before alerting.https://signal-desk-d5t.pages.dev/hunting#hunt-smahttps://signal-desk-d5t.pages.dev/hunting#hunt-smaTue, 13 Oct 2026 00:00:00 +0000hunt ideaReview SMA1000 access logs for unauthenticated requests to unusual Work Place paths, and investigate unexpected connections from the appliance to internal services. Rotate credentials for anything reachable through the appliance's trust context.