Techniques
Sample rules
Large HTTP POST Request Resulting in Server Error
- source: splunk
- technicques:
Description
This analytic detects HTTP POST requests with a body of at least one megabyte that receive an HTTP 500 response. Large failed uploads can indicate attempts to trigger resource exhaustion or exploit vulnerable request handling, including behavior associated with PHP2Shell, but require investigation with related web and application logs.
Detection logic
`zeek_http`
method="POST"
status_code=500
| eval src=coalesce(src, src_ip, 'id.orig_h'),
dest=coalesce(dest, dest_ip, 'id.resp_h'),
dest_port=coalesce(dest_port, 'id.resp_p')
| eval body_bytes=coalesce(tonumber(request_body_len), len(post_body), 0)
| where body_bytes>=1000000
| stats count min(_time) as firstTime
max(_time) as lastTime
max(body_bytes) as body_bytes
values(user_agent) as user_agent
values(status_code) as status_code
by src dest dest_port uri
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `large_http_post_request_resulting_in_server_error_filter`