Name:Cisco Secure Firewall - PHP2Shell Suspicious Upload Activity id:4db3c408-2081-498e-86e8-b35c7c3be910 version:1 date:None author:Splunk status:production type:TTP Description:This analytic detects suspicious PHP web application upload activity using Cisco Secure Firewall Threat Defense Intrusion Events.
The matching network signature identifies a request pattern associated with attempts to exhaust server resources through PHP session handling.
Investigate the source, targeted application, and related web server activity to determine whether the request was part of PHP2Shell exploitation.
Data_source:
search:`cisco_secure_firewall` EventType=IntrusionEvent SignatureID=67360 | fillnull | stats min(_time) as firstTime max(_time) as lastTime values(SignatureID) as SignatureID values(signature) as signature values(class_desc) as class_desc values(MitreAttackGroups) as MitreAttackGroups values(InlineResult) as InlineResult values(InlineResultReason) as InlineResultReason values(src) as src values(dest_port) as dest_port values(rule) as rule values(transport) as transport values(app) as app by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_secure_firewall___php2shell_suspicious_upload_activity_filter`
how_to_implement:This search requires Cisco Secure Firewall Threat Defense logs with IntrusionEvent data.
It uses the `cisco_secure_firewall` input macro, configure it for your environment (index, source, sourcetype).
Ensure intrusion events are collected via the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404) and that the relevant intrusion policy is enabled.
known_false_positives:Approved load testing or unusual multipart uploads may trigger this signature. Review the request context and the targeted service. References: -https://www.php2shell.com/ -https://nvd.nist.gov/vuln/detail/CVE-2026-109619 drilldown_searches: name:'View the detection results for - "$src$" and "$dest$"' search:'%original_detection_search% | search src="$src$" dest="$dest$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$dest$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'7d' latest_offset:'0' analytic_story:['Cisco Secure Firewall Threat Defense Analytics', 'PHP2Shell']
