- ThreatHunting PHP2Shell: the behaviour outlasts the exploit
Hunting PHP2Shell using custom queries in Command Zero, chained into an investigation that ends in a verdict, and a platform-agnostic web server hunt for whatever exploit comes next.
October 2026 · 11 min readRead → - ThreatThe Patch Window Is Gone: What PHP2Shell and Storm-0940 Tell Us About the Investigation Clock
PHP2Shell drew attack traffic before its patch shipped, and Storm-0940 reached privileged cloud access in under three hours. What that means for how fast investigations have to run.
October 2026 · 7 min readRead → - ThreatHunting the ConnectWise (SkyKick) App Abuse with Command Zero
Attackers used ConnectWise's own app credentials to sign in to Microsoft 365 tenants. Here's how to hunt for the sign-ins, the self-assigned roles, and the client secrets they left behind.
October 2026 · 9 min readRead → - ThreatShadow Identities: The Common Attack Target You Can't See
How Command Zero addresses shadow identities
October 2025 · 8 min readRead → - ThreatOperationalizing threat intelligence at scale: Challenges and solutions
The Command Zero experience vs. legacy investigation flows
January 2025 · 9 min readRead → - ThreatRediscover threat hunting and investigations
Command Zero set out to solve the most significant bottleneck for security operations: investigations. There are a lot of solutions (like SIEM, SOAR, SOC automation, AI-powered SOC analysts) available
July 2024 · 7 min readRead →
See what your team can achieve.
Live in under an hour. No migration. No friction.