Large HTTP POST Request Resulting in Server Error

Name:Large HTTP POST Request Resulting in Server Error
id:284ab19f-15f6-4f1c-9a4d-9f331438e37d
version:1
date:None
author:Raven Tait, Onur Mustafa Erdogan, Nasreddine Bencherchali, Splunk
status:production
type:Anomaly
Description:This analytic detects HTTP POST requests with a body of at least one megabyte that receive an HTTP 500 response. Large failed uploads can indicate attempts to trigger resource exhaustion or exploit vulnerable request handling, including behavior associated with PHP2Shell, but require investigation with related web and application logs.
Data_source:

• -Zeek HTTP

search:`zeek_http`
method="POST"
status_code=500

| eval src=coalesce(src, src_ip, 'id.orig_h'),
dest=coalesce(dest, dest_ip, 'id.resp_h'),
dest_port=coalesce(dest_port, 'id.resp_p')

| eval body_bytes=coalesce(tonumber(request_body_len), len(post_body), 0)

| where body_bytes>=1000000

| stats count min(_time) as firstTime
max(_time) as lastTime
max(body_bytes) as body_bytes
values(user_agent) as user_agent
values(status_code) as status_code

by src dest dest_port uri

| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `large_http_post_request_resulting_in_server_error_filter`

how_to_implement:Ingest Zeek `http.log` with the TA for Zeek (https://splunkbase.splunk.com/app/5466), then set the `zeek_http` macro to select that data (the search expects sourcetype `zeek:http` by default). Ensure each record contains `method`, `status_code`, `request_body_len`, `uri`, and endpoint fields such as `id.orig_h`/`id.resp_h` and `id.resp_p` (or the equivalent `src`/`dest` fields). The search uses `request_body_len` for the request size and falls back to `post_body` only when that field is null. It alerts only on HTTP 500 responses.
known_false_positives:Large legitimate uploads can fail because of application limits, timeouts, storage constraints, or transient server errors. Review the request URI, upload size, server logs, and client behavior before classifying the activity as malicious.
References:
  -https://www.php2shell.com/
  -https://github.com/php/php-src/commit/3584a98bda0f2c0d367255b046798b0d3a221a19
  -https://docs.zeek.org/en/master/logs/http.html
drilldown_searches:
  :
analytic_story:['PHP2Shell']

asset_type:Web Application

mitre_attack_id:['T1190']

product:['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']

category:web

security_domain:network

tags:

tests:
 name:'True Positive Test'
 attack_data:
  data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/emerging_threats/php2shell/zeek_large_post_body.log
  source: http.log
  sourcetype: zeek:http
 test_type:'unit'
manual_test:None