PHP2Shell

• Large HTTP POST Request Resulting in Server Error :
  network Web Application None version:1
  This analytic detects HTTP POST requests with a body of at least one megabyte that receive an HTTP 500 response. Large failed uploads can indicate attempts to trigger resource exhaustion or exploit vulnerable request handling, including behavior associated with PHP2Shell, but require investigation with related web and application logs.


• Windows Suspicious Child Process Spawned From WebServer :
  endpoint Endpoint None version:13
  The following analytic identifies the execution of suspicious processes typically associated with WebShell activity on web servers. It detects when processes like `cmd.exe`, `powershell.exe`, or `bash.exe` are spawned by web server processes such as `w3wp.exe` or `nginx.exe`. This behavior is significant as it may indicate an adversary exploiting a web application vulnerability to install a WebShell, providing persistent access and command execution capabilities. If confirmed malicious, this activity could allow attackers to maintain control over the compromised server, execute arbitrary commands, and potentially escalate privileges or exfiltrate sensitive data.


• Inline PHP Code Execution :
  endpoint Endpoint None version:1
  The following analytic detects PHP command-line interpreters executing code supplied directly on the command line with the CLI -r / --run options, or code supplied to PHPDBG through standard input. It covers common CLI executable names on Linux and Windows, including php.exe, php-win.exe, the legacy php-cli.exe name, versioned Linux php binaries, phpdbg, and FrankenPHP's php-cli subcommand. PHP-CGI and PHP-FPM are excluded because they do not support the PHP CLI inline -r option. This behavior can be used legitimately for administration and automation, but unexpected or obfuscated inline PHP execution may indicate an attacker using an installed interpreter to run commands without dropping a script file.


• PHP Session Upload Progress Serialized Payload in Upload Filename :
  network Web Application None version:1
  This analytic detects multipart POST requests containing the "PHP_SESSION_UPLOAD_PROGRESS" form field and a serialized PHP structure in an uploaded filename. This combination may indicate an attempt to exploit PHP session upload-progress handling and can be associated with PHP2Shell activity.


• PHP Memory Exhaustion Exploitation Attempt via Multipart Request :
  network Web Application None version:1
  This analytic correlates Apache and Nginx access and error logs when "multipart/form-data" requests and PHP memory-limit exhaustion errors occur for the same PID, host, and client. It extracts web request details and "PHP" error messages to support investigation of possible PHP2Shell exploitation attempts.


• Web or Application Server Spawning a Shell :
  endpoint Endpoint None version:6
  The following analytic detects instances where Java, or Tomcat processes spawn a Linux shell, which may indicate exploitation attempts, such as those related to CVE-2021-44228 (Log4Shell). This detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process names and parent-child process relationships. This activity is significant as it can signify a compromised Java application, potentially leading to unauthorized shell access. If confirmed malicious, attackers could execute arbitrary commands, escalate privileges, or maintain persistent access, posing a severe threat to the environment.


• PHP Session Upload Progress with PHP Code in Upload Filename :
  network Web Application None version:1
  This analytic detects multipart POST requests containing a PHPSESSID form field and an uploaded filename with a PHP opening tag. When observed with "PHP_SESSION_UPLOAD_PROGRESS" behavior, this may indicate an attempt to place executable PHP content into session-related data as part of PHP2Shell exploitation.