approved load testing or unusual multipart uploads may trigger this signature. review the request context and the targeted service.

splunk

Techniques

Sample rules

Cisco Secure Firewall - PHP2Shell Suspicious Upload Activity

source: splunk
technicques:

Description

This analytic detects suspicious PHP web application upload activity using Cisco Secure Firewall Threat Defense Intrusion Events. The matching network signature identifies a request pattern associated with attempts to exhaust server resources through PHP session handling. Investigate the source, targeted application, and related web server activity to determine whether the request was part of PHP2Shell exploitation.

Detection logic

`cisco_secure_firewall` EventType=IntrusionEvent SignatureID=67360

| fillnull

| stats min(_time) as firstTime
        max(_time) as lastTime
        values(SignatureID) as SignatureID
        values(signature) as signature
        values(class_desc) as class_desc
        values(MitreAttackGroups) as MitreAttackGroups
        values(InlineResult) as InlineResult
        values(InlineResultReason) as InlineResultReason
        values(src) as src
        values(dest_port) as dest_port
        values(rule) as rule
        values(transport) as transport
        values(app) as app
        by dest

| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| `cisco_secure_firewall___php2shell_suspicious_upload_activity_filter`