Name:Cisco Secure Firewall - PHP2Shell Exploitation Attempt id:9a6b3ab0-4549-459b-9f89-f753bf92a53f version:1 date:None author:Splunk status:production type:TTP Description:This correlation analytic identifies likely PHP2Shell exploitation attempts by correlating a PHP memory disclosure indicator
with either of two independent PHP web exploitation indicators from Cisco Secure Firewall Threat Defense Intrusion Events.
Seeing these behaviors from the same source against the same destination within a short period can indicate an attempt to
improve the reliability of subsequent exploitation. Investigate the complete network and web server activity.
Data_source:
search:`cisco_secure_firewall` EventType=IntrusionEvent SignatureID IN (67359, 67360, 67375) | bin _time span=5m | fillnull | stats dc(SignatureID) as unique_signature_count values(SignatureID) as SignatureID values(signature) as signature values(class_desc) as class_desc values(MitreAttackGroups) as MitreAttackGroups values(InlineResult) as InlineResult values(InlineResultReason) as InlineResultReason values(dest_port) as dest_port values(rule) as rule values(transport) as transport values(app) as app min(_time) as firstTime max(_time) as lastTime count(eval(SignatureID=67375)) as sig_memory_disclosure count(eval(SignatureID=67359)) as sig_serialized_activity count(eval(SignatureID=67360)) as sig_upload_activity by _time src dest | where sig_memory_disclosure >= 1 AND (sig_serialized_activity >= 1 OR sig_upload_activity >= 1) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_secure_firewall___php2shell_exploitation_attempt_filter`
how_to_implement:This search requires Cisco Secure Firewall Threat Defense logs with IntrusionEvent data.
It uses the `cisco_secure_firewall` input macro, configure it for your environment (index, source, sourcetype).
Ensure intrusion events are collected via the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404) and that the relevant intrusion policy is enabled.
known_false_positives:Security testing may trigger multiple related signatures. Review event timing, source, destination, and application context. References: -https://www.php2shell.com/ -https://nvd.nist.gov/vuln/detail/CVE-2026-109618 -https://nvd.nist.gov/vuln/detail/CVE-2026-109619 drilldown_searches: name:'View the detection results for - "$src$" and "$dest$"' search:'%original_detection_search% | search src="$src$" dest="$dest$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$dest$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'7d' latest_offset:'0' analytic_story:['Cisco Secure Firewall Threat Defense Analytics', 'PHP2Shell']
