Techniques
Sample rules
Cisco Secure Firewall - PHP2Shell Exploitation Attempt
- source: splunk
- technicques:
Description
This correlation analytic identifies likely PHP2Shell exploitation attempts by correlating a PHP memory disclosure indicator with either of two independent PHP web exploitation indicators from Cisco Secure Firewall Threat Defense Intrusion Events. Seeing these behaviors from the same source against the same destination within a short period can indicate an attempt to improve the reliability of subsequent exploitation. Investigate the complete network and web server activity.
Detection logic
`cisco_secure_firewall` EventType=IntrusionEvent SignatureID IN (67359, 67360, 67375)
| bin _time span=5m
| fillnull
| stats dc(SignatureID) as unique_signature_count
values(SignatureID) as SignatureID
values(signature) as signature
values(class_desc) as class_desc
values(MitreAttackGroups) as MitreAttackGroups
values(InlineResult) as InlineResult
values(InlineResultReason) as InlineResultReason
values(dest_port) as dest_port
values(rule) as rule
values(transport) as transport
values(app) as app
min(_time) as firstTime
max(_time) as lastTime
count(eval(SignatureID=67375)) as sig_memory_disclosure
count(eval(SignatureID=67359)) as sig_serialized_activity
count(eval(SignatureID=67360)) as sig_upload_activity
by _time src dest
| where sig_memory_disclosure >= 1 AND (sig_serialized_activity >= 1 OR sig_upload_activity >= 1)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `cisco_secure_firewall___php2shell_exploitation_attempt_filter`