Cisco Secure Firewall - PHP2Shell Exploitation Attempt

This correlation analytic identifies likely PHP2Shell exploitation attempts by correlating a PHP memory disclosure indicator with either of two independent PHP web exploitation indicators from Cisco Secure Firewall Threat Defense Intrusion Events. Seeing these behaviors from the same source against the same destination within a short period can indicate an attempt to improve the reliability of subsequent exploitation. Investigate the complete network and web server activity.