PHP Session Upload Progress with PHP Code in Upload Filename

Name:PHP Session Upload Progress with PHP Code in Upload Filename
id:e50cc2d0-7c71-4a2f-83dc-5ee6d4bb76a7
version:1
date:None
author:Raven Tait, Onur Mustafa Erdogan, Nasreddine Bencherchali, Splunk
status:production
type:Anomaly
Description:This analytic detects multipart POST requests containing a PHPSESSID form field and an uploaded filename with a PHP opening tag. When observed with "PHP_SESSION_UPLOAD_PROGRESS" behavior, this may indicate an attempt to place executable PHP content into session-related data as part of PHP2Shell exploitation.
Data_source:

• -Zeek HTTP

search:`zeek_http`
method="POST"
request_headers="*"

| eval src=coalesce(src, src_ip, 'id.orig_h'),
dest=coalesce(dest, dest_ip, 'id.resp_h'),
dest_port=coalesce(dest_port, 'id.resp_p')

| eval has_phpsessid_field=if(match(request_headers, "(?im)\s*form-data;[^\\r\\n]*\\bname\\s*=\\s*\\\"?PHPSESSID\\\"?(?:;|[\\r\\n]|$)"), 1, 0)

| rex max_match=0 field=request_headers "(?im)\s*form-data;(?<part_disposition>[^\\r\\n]*)"

| eval php_open_tag_filenames=mvfilter(match(part_disposition, "(?i)\\bfilename\\s*=.*(?:<\\?php\\b|<\\?=)"))

| where has_phpsessid_field=1 AND mvcount(php_open_tag_filenames)>0

| stats count min(_time) as firstTime
max(_time) as lastTime
values(status_code) as status_code
values(user_agent) as user_agent
values(php_open_tag_filenames) as php_open_tag_filenames

by src dest dest_port uri

| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `php_session_upload_progress_with_php_code_in_upload_filename_filter`

how_to_implement:Zeek HTTP logs must be ingested into Splunk using the latest version of Splunk Add-on for Zeek (https://splunkbase.splunk.com/app/5466). Configure the `zeek_http` macro to match the sourcetype used by your Zeek add-on.
known_false_positives:Security testing tools or development environments may upload files with PHP code in the filename. Review the request headers, destination application, and any follow-on requests or server-side execution evidence.
References:
  -https://www.php2shell.com/
  -https://github.com/php/php-src/commit/3584a98bda0f2c0d367255b046798b0d3a221a19
  -https://docs.zeek.org/en/master/logs/http.html
drilldown_searches:
  :
analytic_story:['PHP2Shell']

asset_type:Web Application

mitre_attack_id:['T1190']

product:['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']

category:web

security_domain:network

tags:

tests:
 name:'True Positive Test'
 attack_data:
  data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/emerging_threats/php2shell/php_tag_filename.log
  source: http.log
  sourcetype: zeek:http
 test_type:'unit'
manual_test:None