applications may upload files with names containing serialized-looking text as part of testing or unusual workflows. review the complete request headers, source, destination, and application context before determining intent.

splunk

Techniques

Sample rules

PHP Session Upload Progress Serialized Payload in Upload Filename

source: splunk
technicques:

Description

This analytic detects multipart POST requests containing the “PHP_SESSION_UPLOAD_PROGRESS” form field and a serialized PHP structure in an uploaded filename. This combination may indicate an attempt to exploit PHP session upload-progress handling and can be associated with PHP2Shell activity.

Detection logic

`zeek_http`
method="POST"
request_headers="*"


| eval src=coalesce(src, src_ip, 'id.orig_h'),
       dest=coalesce(dest, dest_ip, 'id.resp_h'),
       dest_port=coalesce(dest_port, 'id.resp_p')


| eval has_upload_progress_field=if(match(request_headers, "(?im)\s*form-data;\\s*name=\\\"PHP_SESSION_UPLOAD_PROGRESS\\\""), 1, 0)


| rex max_match=0 field=request_headers "(?im)\s*form-data;(?<part_disposition>[^\\r\\n]*)"


| eval serialized_filename_headers=mvfilter(match(part_disposition, "(?i)\\bfilename\\s*=.*(?:\\
|?O:\\d+:
|C:\\d+:
|a:\\d+:\\{
|s:\\d+:
|E:\\d+:
|R:\\d+;
|i:-?\\d+;
|d:(?:[-+]?(?:\\d+(?:\\.\\d*)?
|\\.\\d+)(?:[eE][-+]?\\d+)?
|INF
|NAN);
|b:[01];
|N;)"))


| where has_upload_progress_field=1 AND mvcount(serialized_filename_headers)>0


| stats count min(_time) as firstTime
              max(_time) as lastTime
              values(method) as method
              values(status_code) as status_code
              values(user_agent) as user_agent
              values(serialized_filename_headers) as serialized_filename_headers

  by src dest dest_port uri


| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| `php_session_upload_progress_serialized_payload_in_upload_filename_filter`