PHP2Shell

• Large HTTP POST Request Resulting in Server Error :
  network Web Application None version:1
  This analytic detects HTTP POST requests with a body of at least one megabyte that receive an HTTP 500 response. Large failed uploads can indicate attempts to trigger resource exhaustion or exploit vulnerable request handling, including behavior associated with PHP2Shell, but require investigation with related web and application logs.


• Windows Suspicious Child Process Spawned From WebServer :
  endpoint Endpoint None version:14
  This analytic detects selected system, scripting, discovery, and administration utilities spawned by Windows web or application server processes. Parent processes include common web server and application server services; Java and JavaW parents are included when their command lines identify known server frameworks or applications. Unexpected child process activity may indicate that an exposed application or web server has been abused to run commands on the host. Review the parent command line, child process, user, and surrounding activity to determine whether the behavior is authorized.


• Inline PHP Code Execution :
  endpoint Endpoint None version:2
  The following analytic detects PHP command-line interpreters executing code supplied directly on the command line with the CLI -r / --run options, per-line execution flags, non-empty auto-prepend or auto-append settings, or code supplied to PHPDBG through standard input. It covers common CLI executable names on Linux and Windows, including php.exe, php-win.exe, the legacy php-cli.exe name, versioned Linux php binaries, phpdbg, and FrankenPHP's php-cli subcommand. PHP-CGI and PHP-FPM are excluded because they do not support the PHP CLI inline -r option. This behavior can be used legitimately for administration and automation, but unexpected or obfuscated inline PHP execution may indicate an attacker using an installed interpreter to run commands without dropping a script file.


• PHP Session Upload Progress Serialized Payload in Upload Filename :
  network Web Application None version:1
  This analytic detects multipart POST requests containing the "PHP_SESSION_UPLOAD_PROGRESS" form field and a serialized PHP structure in an uploaded filename. This combination may indicate an attempt to exploit PHP session upload-progress handling and can be associated with PHP2Shell activity.


• Cisco Secure Firewall - PHP2Shell Suspicious Upload Activity :
  network Network None version:1
  This analytic detects suspicious PHP web application upload activity using Cisco Secure Firewall Threat Defense Intrusion Events. The matching network signature identifies a request pattern associated with attempts to exhaust server resources through PHP session handling. Investigate the source, targeted application, and related web server activity to determine whether the request was part of PHP2Shell exploitation.


• PHP Memory Exhaustion Exploitation Attempt via Multipart Request :
  network Web Application None version:2
  This analytic correlates Apache and Nginx access and error logs when "multipart/form-data" requests and PHP memory-limit exhaustion errors occur for the same PID, host, and client. It extracts web request details and "PHP" error messages to support investigation of possible PHP2Shell exploitation attempts.


• Cisco Secure Firewall - PHP2Shell Serialized Payload Activity :
  network Network None version:1
  This analytic detects suspicious PHP web application requests using Cisco Secure Firewall Threat Defense Intrusion Events. The matching network signature identifies a serialized input pattern associated with attempts to exploit PHP request handling. Investigate the source, targeted application, and related web server activity to determine whether the request was part of PHP2Shell exploitation.


• PHP Opening Tag in Upload Filename - Suricata :
  network Web Application None version:1
  This analytic detects Suricata multipart POST events with an uploaded filename containing a PHP opening tag. Suricata EVE HTTP events do not expose multipart form field names, so this variant cannot confirm the PHPSESSID or PHP_SESSION_UPLOAD_PROGRESS fields without additional request-body inspection. The filename pattern may indicate an attempt to place executable PHP content into session-related data as part of PHP2Shell exploitation.


• Web or Application Server Spawning a Shell :
  endpoint Endpoint None version:7
  The following analytic detects instances where Java, web server, or application server processes spawn a Linux shell, which may indicate exploitation attempts. This detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process names and parent-child process relationships. This activity may indicate a compromised service leading to unauthorized shell access. If confirmed malicious, attackers could execute commands, escalate privileges, or maintain persistent access.


• Cisco Secure Firewall - PHP2Shell Exploitation Attempt :
  network Network None version:1
  This correlation analytic identifies likely PHP2Shell exploitation attempts by correlating a PHP memory disclosure indicator with either of two independent PHP web exploitation indicators from Cisco Secure Firewall Threat Defense Intrusion Events. Seeing these behaviors from the same source against the same destination within a short period can indicate an attempt to improve the reliability of subsequent exploitation. Investigate the complete network and web server activity.


• Large HTTP POST Request Failure or Missing Response - Suricata :
  network Web Application None version:1
  This analytic detects HTTP POST requests with a declared body size of at least one megabyte that receive an HTTP 500 response or have no response status recorded. Large failed or unanswered uploads can indicate attempts to trigger resource exhaustion or exploit vulnerable request handling, including behavior associated with PHP2Shell, but require investigation with related web and application logs.


• PHP Session Upload Progress with PHP Code in Upload Filename :
  network Web Application None version:1
  This analytic detects multipart POST requests containing a PHPSESSID form field and an uploaded filename with a PHP opening tag. When observed with "PHP_SESSION_UPLOAD_PROGRESS" behavior, this may indicate an attempt to place executable PHP content into session-related data as part of PHP2Shell exploitation.


• Serialized PHP Token in Upload Filename - Suricata :
  network Web Application None version:1
  This analytic detects multipart POST traffic with a serialized PHP structure in an uploaded filename, which may indicate an attempt to exploit PHP session upload-progress handling and can be associated with PHP2Shell activity. Suricata EVE's standard HTTP events do not expose multipart form field names, so this Suricata variant cannot confirm the PHP_SESSION_UPLOAD_PROGRESS field without additional request-body inspection.