PHP Memory Exhaustion Exploitation Attempt via Multipart Request

Name:PHP Memory Exhaustion Exploitation Attempt via Multipart Request
id:53db8c3a-aea4-4eef-9cb4-a20c84b7f133
version:2
date:None
author:Onur Mustafa Erdogan, Raven Tait, Nasreddine Bencherchali, Splunk
status:production
type:Anomaly
Description:This analytic correlates Apache and Nginx access and error logs when "multipart/form-data" requests and PHP memory-limit exhaustion errors occur for the same PID, host, and client. It extracts web request details and "PHP" error messages to support investigation of possible PHP2Shell exploitation attempts.
Data_source:

• -Nginx Access
• -Nginx Error Log

search:(
`apache_access_logs`
OR
`apache_error_logs`
OR
`nginx_access_logs`
OR
`nginx_error_logs`
)
(
(http_content_type="multipart/form-data*" AND http_method=POST)
OR
(
"Allowed memory size of"
AND
"bytes exhausted"
)
)

| rex field=_raw "\[pid\s+(?<pid>\d+)"
| rex field=_raw "\]\s+(?<pid>\d+)\#\d+\:"

| rex field=_raw "client\:?\s+(?<client>.*?)(?:,|\]|$)"
| rex mode=sed field=client "s/\:\d+$//g"

| rex field=_raw "server\:\s+(?<server>.*?)(?:,\s|$)"

| rex field=_raw "request\:\s+\"(?<method>\w+)\s+(?<uri>.*?)\s+HTTP\/\d+\.\d+\"(?:,\s|$)"

| rex field=_raw "(?i)PHP(?:\s+\w+){1,}:\s+(?<error_message>.*?)$"

| eval pid=coalesce(worker_pid,process_id,pid)
| eval message=coalesce(error_message,message)
| eval src=coalesce(client,src,src_ip)
| eval dest=coalesce(server,dest,dest_ip)
| eval uri_query=coalesce(uri_query,"")
| eval uri_path=coalesce(uri_path,"")
| eval uri=coalesce(uri_path.uri_query,uri)

| stats count min(_time) as firstTime last(_time) as lastTime
dc(source) as dc_source
values(source) as source
values(http_method) as http_method
values(dest) as dest
values(dest_port) as dest_port
values(site) as site
values(uri) as uri
values(url) as url
values(status) as status
values(memory_bytes) as memory_bytes
values(http_content_length) as http_content_length
values(http_content_type) as http_content_type
values(http_referrer) as http_referrer
values(http_user_agent) as http_user_agent
values(message) as message
by pid host src
| where mvfind(source,"access")>=0 AND mvfind(source,"error")>=0

| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `php_memory_exhaustion_exploitation_attempt_via_multipart_request_filter`

how_to_implement:Ingest Apache (https://splunkbase.splunk.com/app/3186) and/or Nginx (https://splunkbase.splunk.com/app/3258) access and error logs into Splunk using their default Splunk add-ons. Follow configuration instructions provided by the respective Splunk add-ons for Apache (https://splunk.github.io/splunk-add-on-for-apache-web-server/Configure/) and Nginx (https://splunk.github.io/splunk-add-on-for-nginx/Setupv2/). In addition to default log formats, enable logging of worker PID (process ID) in both access and error logs. Make sure that you configure the `apache_access_logs` and `apache_error_logs` or `nginx_access_logs` and `nginx_error_logs` macros with the corresponding source and sourcetype patterns for your environment.
known_false_positives:Legitimate large multipart uploads, application bugs, or load tests can cause memory-limit errors. Review the correlated access and PHP error events before classifying this activity as exploitation.
References:
  -https://www.php2shell.com/
  -https://github.com/php/php-src/commit/3584a98bda0f2c0d367255b046798b0d3a221a19
drilldown_searches:
  :
analytic_story:['PHP2Shell']

asset_type:Web Application

mitre_attack_id:['T1190']

product:['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']

category:web

security_domain:network

tags:

tests:
 name:'True Positive Test'
 attack_data:
  data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/emerging_threats/php2shell/memory_exhaustion_error.log
  source: /var/log/nginx/error.log
  sourcetype: nginx:plus:error
  data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/emerging_threats/php2shell/memory_exhaustion_access.log
  source: /var/log/nginx/access.log
  sourcetype: nginx:plus:kv
 test_type:'unit'
manual_test:None