PHP2Shell upload.php recon-to-large-multipart POST sequence from one source
Detects a suspicious sequence of HTTP requests to an upload endpoint (/upload.php) characterized by alternating GET and POST requests across multiple session cookies, culminating in a large POST body within a short time window. This behavior often indicates web shell staging, file upload exploitation, or automated scanning and exploitation tools targeting web applications.
Microsoft Sentinel (KQL)
