legitimate large multipart uploads, application bugs, or load tests can cause memory-limit errors. review the correlated access and php error events before classifying this activity as exploitation.

splunk

Techniques

Sample rules

PHP Memory Exhaustion Exploitation Attempt via Multipart Request

source: splunk
technicques:

Description

This analytic correlates Apache and Nginx access and error logs when “multipart/form-data” requests and PHP memory-limit exhaustion errors occur for the same PID, host, and client. It extracts web request details and “PHP” error messages to support investigation of possible PHP2Shell exploitation attempts.

Detection logic

(
    `apache_access_logs`
    OR
    `apache_error_logs`
    OR
    `nginx_access_logs`
    OR
    `nginx_error_logs`
)
(
    "multipart/form-data"
    OR
    (
        "Allowed memory size of"
        AND
        "bytes exhausted"
    )
)


| rex field=_raw "\[pid\s+(?<pid>\d+)"

| rex field=_raw "\]\s+(?<pid>\d+)\#\d+\:"


| rex field=_raw "client\:?\s+(?<client>.*?)(?:,
|\]
|$)"

| rex mode=sed field=client "s/\:\d+$//g"


| rex field=_raw "server\:\s+(?<server>.*?)(?:,\s
|$)"


| rex field=_raw "request\:\s+\"(?<method>\w+)\s+(?<uri>.*?)\s+HTTP\/\d+\.\d+\"(?:,\s
|$)"


| rex field=_raw "(?i)PHP(?:\s+\w+){1,}:\s+(?<error_message>.*?)$"


| eval pid=coalesce(worker_pid,pid)

| eval message=coalesce(error_message,message)

| eval src=coalesce(client,src,src_ip)

| eval dest=coalesce(server,dest,dest_ip)

| eval http_method=coalesce(method,http_method)

| eval http_content_length=coalesce(content_length,http_content_length)

| eval http_content_type=coalesce(content_type,http_content_type)

| eval http_user_agent=coalesce(user_agent,http_user_agent)

| eval http_referrer=coalesce(referrer,http_referrer)


| stats count min(_time) as firstTime last(_time) as lastTime
    dc(source) as dc_source
    values(source) as source
    values(http_method) as http_method
    values(dest) as dest
    values(dest_port) as dest_port
    values(site) as site
    values(uri) as uri
    values(status) as status
    values(memory_bytes) as memory_bytes
    values(http_content_length) as http_content_length
    values(http_content_type) as http_content_type
    values(http_referrer) as http_referrer
    values(http_user_agent) as http_user_agent
    values(message) as message
    by pid host src

| where mvfind(source,"access")>=0 AND mvfind(source,"error")>=0


| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| `php_memory_exhaustion_exploitation_attempt_via_multipart_request_filter`