Name:PHP Session Upload Progress Serialized Payload in Upload Filename id:47b3ff26-c4cc-4413-9bf3-f44dbac36785 version:1 date:None author:Raven Tait, Onur Mustafa Erdogan, Nasreddine Bencherchali, Splunk status:production type:Anomaly Description:This analytic detects multipart POST requests containing the "PHP_SESSION_UPLOAD_PROGRESS" form field and a serialized PHP structure in an uploaded filename.
This combination may indicate an attempt to exploit PHP session upload-progress handling and can be associated with PHP2Shell activity. Data_source:
| where has_upload_progress_field=1 AND mvcount(serialized_filename_headers)>0
| stats count min(_time) as firstTime max(_time) as lastTime values(method) as method values(status_code) as status_code values(user_agent) as user_agent values(serialized_filename_headers) as serialized_filename_headers
how_to_implement:Zeek HTTP logs must be ingested into Splunk using the latest version of Splunk Add-on for Zeek (https://splunkbase.splunk.com/app/5466).
Configure the `zeek_http` macro to match the sourcetype used by your Zeek add-on. known_false_positives:Applications may upload files with names containing serialized-looking text as part of testing or unusual workflows. Review the complete request headers, source, destination, and application context before determining intent. References: -https://www.php2shell.com/ -https://github.com/php/php-src/commit/3584a98bda0f2c0d367255b046798b0d3a221a19 -https://docs.zeek.org/en/master/logs/http.html drilldown_searches:
: analytic_story:['PHP2Shell']
