security testing or applications that legitimately submit serialized php data may trigger this signature. review the request context and the targeted service.

splunk

Techniques

Sample rules

Cisco Secure Firewall - PHP2Shell Serialized Payload Activity

source: splunk
technicques:

Description

This analytic detects suspicious PHP web application requests using Cisco Secure Firewall Threat Defense Intrusion Events. The matching network signature identifies a serialized input pattern associated with attempts to exploit PHP request handling. Investigate the source, targeted application, and related web server activity to determine whether the request was part of PHP2Shell exploitation.

Detection logic

`cisco_secure_firewall` EventType=IntrusionEvent SignatureID=67359

| fillnull

| stats min(_time) as firstTime
        max(_time) as lastTime
        values(SignatureID) as SignatureID
        values(signature) as signature
        values(class_desc) as class_desc
        values(MitreAttackGroups) as MitreAttackGroups
        values(InlineResult) as InlineResult
        values(InlineResultReason) as InlineResultReason
        values(src) as src
        values(dest_port) as dest_port
        values(rule) as rule
        values(transport) as transport
        values(app) as app
        by dest

| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| `cisco_secure_firewall___php2shell_serialized_payload_activity_filter`