Name:Serialized PHP Token in Upload Filename - Suricata id:f5abaeab-eabd-4b8a-bc62-ec3d3722e4fe version:1 date:None author:Raven Tait, Onur Mustafa Erdogan, Nasreddine Bencherchali, Splunk status:production type:Anomaly Description:This analytic detects multipart POST traffic with a serialized PHP structure in an uploaded filename, which may indicate an attempt to exploit PHP session upload-progress handling and can be associated with PHP2Shell activity.
Suricata EVE's standard HTTP events do not expose multipart form field names, so this Suricata variant cannot confirm the PHP_SESSION_UPLOAD_PROGRESS field without additional request-body inspection. Data_source:
-Suricata
search:`suricata` http_method=POST fileinfo.filename=* | rex field=fileinfo.filename max_match=0 "(?i)(?<serialization_token>\|?O:\d+:|C:\d+:|a:\d+:\{|[sS]:\d+:|E:\d+:|[rR]:\d+;|i:-?\d+;|d:(?:[-+]?(?:\d+(?:\.\d*)?|\.\d+)(?:[eE][-+]?\d+)?|INF|NAN);|b:[01];|N;)" | where isnotnull(serialization_token) | rename dest_ip as dest | rename src_ip as src | stats count min(_time) as firstTime max(_time) as lastTime values(serialization_token) as serialization_tokens values(http_content_type) as http_content_type by fileinfo.filename, src, src_port, dest, dest_port, url, http_method | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `serialized_php_token_in_upload_filename___suricata_filter`
how_to_implement:Configure Suricata EVE JSON to emit HTTP and fileinfo events, and ingest the JSON with the Splunk TA for
Suricata. Set the `suricata` macro to the TA's sourcetype (commonly `sourcetype=suricata`). Verify that
POST file events expose `http_method`, `fileinfo.filename`, `src_ip`, `src_port`, `dest_ip`, `dest_port`,
and the HTTP URL/content type fields used by the search. This rule matches serialized PHP tokens in the
filename only; Suricata EVE does not provide multipart form field names, so it cannot verify
PHP_SESSION_UPLOAD_PROGRESS. known_false_positives:Applications may upload files with names containing serialized-looking text as part of testing or unusual workflows. Review the filename, source, destination, and application context before determining intent. References: -https://www.php2shell.com/ -https://github.com/php/php-src/commit/3584a98bda0f2c0d367255b046798b0d3a221a19 -https://docs.suricata.io/en/suricata-8.0.3/output/eve/eve-json-output.html drilldown_searches:
: analytic_story:['PHP2Shell']
