ATT&CK T1505.003 - Web Shell Upload Attempt (PHP)

Darshan Thummar@Mighty

•updated Jun 10, 2026•1•0•3

This rule detects attempts to upload a web shell, specifically targeting PHP files, by looking for HTTP POST requests to a .php URI that contain the string "eval(" in the file data. This combination suggests an attacker is trying to upload or execute malicious PHP code, often used for persistence or further compromise.