Name:PHP Session Upload Progress Serialized Payload in Upload Filename id:47b3ff26-c4cc-4413-9bf3-f44dbac36785 version:1 date:None author:Raven Tait, Onur Mustafa Erdogan, Nasreddine Bencherchali, Splunk status:production type:Anomaly Description:This analytic detects multipart POST requests containing the "PHP_SESSION_UPLOAD_PROGRESS" form field and a serialized PHP structure in an uploaded filename.
This combination may indicate an attempt to exploit PHP session upload-progress handling and can be associated with PHP2Shell activity. Data_source:
| where has_upload_progress_field=1 AND mvcount(serialized_filename_headers)>0
| stats count min(_time) as firstTime max(_time) as lastTime values(method) as method values(status_code) as status_code values(user_agent) as user_agent values(serialized_filename_headers) as serialized_filename_headers
how_to_implement:Ingest Zeek `http.log` with the TA for Zeek (https://splunkbase.splunk.com/app/5466), then set the
`zeek_http` macro to select that data (the search expects sourcetype `zeek:http` by default). Standard
Zeek HTTP logs do not include full multipart request headers. Enable a Zeek HTTP header logging script or
package that captures client header names and values, and map them into `request_headers`. Each POST
record must include the `Content-Disposition` lines so the search can see
`name="PHP_SESSION_UPLOAD_PROGRESS"` and an upload `filename` containing a serialized PHP token. known_false_positives:Applications may upload files with names containing serialized-looking text as part of testing or unusual workflows. Review the complete request headers, source, destination, and application context before determining intent. References: -https://www.php2shell.com/ -https://github.com/php/php-src/commit/3584a98bda0f2c0d367255b046798b0d3a221a19 -https://docs.zeek.org/en/master/logs/http.html -https://docs.zeek.org/en/master/scripts/policy/protocols/http/header-names.zeek.html drilldown_searches:
: analytic_story:['PHP2Shell']
