Name:Cisco Secure Firewall - PHP2Shell Serialized Payload Activity id:60ad33a2-6fa8-4d13-b7be-fbe5167ea0ca version:1 date:None author:Nasreddine Bencherchali, Splunk status:production type:TTP Description:This analytic detects suspicious PHP web application requests using Cisco Secure Firewall Threat Defense Intrusion Events.
The matching network signature identifies a serialized input pattern associated with attempts to exploit PHP request handling.
Investigate the source, targeted application, and related web server activity to determine whether the request was part of PHP2Shell exploitation.
Data_source:
search:`cisco_secure_firewall` EventType=IntrusionEvent SignatureID=67359 | fillnull | stats min(_time) as firstTime max(_time) as lastTime values(SignatureID) as SignatureID values(signature) as signature values(class_desc) as class_desc values(MitreAttackGroups) as MitreAttackGroups values(InlineResult) as InlineResult values(InlineResultReason) as InlineResultReason values(src) as src values(dest_port) as dest_port values(rule) as rule values(transport) as transport values(app) as app by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_secure_firewall___php2shell_serialized_payload_activity_filter`
how_to_implement:This search requires Cisco Secure Firewall Threat Defense logs with IntrusionEvent data.
It uses the `cisco_secure_firewall` input macro, configure it for your environment (index, source, sourcetype).
Ensure intrusion events are collected via the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404) and that the relevant intrusion policy is enabled.
known_false_positives:Security testing or applications that legitimately submit serialized PHP data may trigger this signature. Review the request context and the targeted service. References: -https://www.php2shell.com/ -https://nvd.nist.gov/vuln/detail/CVE-2026-109618 -https://nvd.nist.gov/vuln/detail/CVE-2026-109619 drilldown_searches: name:'View the detection results for - "$src$" and "$dest$"' search:'%original_detection_search% | search src="$src$" dest="$dest$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$dest$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'7d' latest_offset:'0' analytic_story:['Cisco Secure Firewall Threat Defense Analytics', 'PHP2Shell']
