Splunk Security
@SplunkSecurity35 followers31,482 downloads1,576 copies11 likes89,167 views
2,496 detections
Filters
Last updated
All Time
Detection languages
2,496
Categories
828
522
264
239
208
Platforms
1,607
255
203
142
100
Products / Services
1,226
896
791
217
212
MITRE Techniques
932
661
510
495
306
CVEs
18
12
11
10
9
The following analytic detects PHP command-line interpreters executing code supplied directly on the command line with the CLI -r / --run options, or code supplied to PHPDBG through standard input.
It covers common CLI executable names on Linux and Windows, including php.exe, php-win.exe, the legacy php-cli.exe name, versioned Linux php binaries, phpdbg, and FrankenPHP's php-cli subcommand.
PHP-CGI and PHP-FPM are excluded because they do not support the PHP CLI inline -r option.
This behavior can be used legitimately for administration and automation, but unexpected or obfuscated inline PHP execution may indicate an attacker using an installed interpreter to run commands without dropping a script file.
It covers common CLI executable names on Linux and Windows, including php.exe, php-win.exe, the legacy php-cli.exe name, versioned Linux php binaries, phpdbg, and FrankenPHP's php-cli subcommand.
PHP-CGI and PHP-FPM are excluded because they do not support the PHP CLI inline -r option.
This behavior can be used legitimately for administration and automation, but unexpected or obfuscated inline PHP execution may indicate an attacker using an installed interpreter to run commands without dropping a script file.
The following analytic detects instances where Java, or Tomcat processes spawn a Linux shell, which may indicate exploitation attempts, such as those related to CVE-2021-44228 (Log4Shell).
This detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process names and parent-child process relationships.
This activity is significant as it can signify a compromised Java application, potentially leading to unauthorized shell access.
If confirmed malicious, attackers could execute arbitrary commands, escalate privileges, or maintain persistent access, posing a severe threat to the environment.
This detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process names and parent-child process relationships.
This activity is significant as it can signify a compromised Java application, potentially leading to unauthorized shell access.
If confirmed malicious, attackers could execute arbitrary commands, escalate privileges, or maintain persistent access, posing a severe threat to the environment.
This analytic detects multipart POST requests containing a PHPSESSID form field and an uploaded filename with a PHP opening tag.
When observed with "PHP_SESSION_UPLOAD_PROGRESS" behavior, this may indicate an attempt to place executable PHP content into session-related data as part of PHP2Shell exploitation.
When observed with "PHP_SESSION_UPLOAD_PROGRESS" behavior, this may indicate an attempt to place executable PHP content into session-related data as part of PHP2Shell exploitation.
This analytic correlates Apache and Nginx access and error logs when "multipart/form-data" requests and PHP memory-limit exhaustion errors occur for the same PID, host, and client.
It extracts web request details and "PHP" error messages to support investigation of possible PHP2Shell exploitation attempts.
It extracts web request details and "PHP" error messages to support investigation of possible PHP2Shell exploitation attempts.
This analytic detects HTTP POST requests with a body of at least one megabyte that receive an HTTP 500 response.
Large failed uploads can indicate attempts to trigger resource exhaustion or exploit vulnerable request handling, including behavior associated with PHP2Shell, but require investigation with related web and application logs.
Large failed uploads can indicate attempts to trigger resource exhaustion or exploit vulnerable request handling, including behavior associated with PHP2Shell, but require investigation with related web and application logs.
The following analytic identifies the execution of suspicious processes typically associated with WebShell activity on web servers.
It detects when processes like `cmd.exe`, `powershell.exe`, or `bash.exe` are spawned by web server processes such as `w3wp.exe` or `nginx.exe`.
This behavior is significant as it may indicate an adversary exploiting a web application vulnerability to install a WebShell, providing persistent access and command execution capabilities.
If confirmed malicious, this activity could allow attackers to maintain control over the compromised server, execute arbitrary commands, and potentially escalate privileges or exfiltrate sensitive data.
It detects when processes like `cmd.exe`, `powershell.exe`, or `bash.exe` are spawned by web server processes such as `w3wp.exe` or `nginx.exe`.
This behavior is significant as it may indicate an adversary exploiting a web application vulnerability to install a WebShell, providing persistent access and command execution capabilities.
If confirmed malicious, this activity could allow attackers to maintain control over the compromised server, execute arbitrary commands, and potentially escalate privileges or exfiltrate sensitive data.
This analytic detects multipart POST requests containing the "PHP_SESSION_UPLOAD_PROGRESS" form field and a serialized PHP structure in an uploaded filename.
This combination may indicate an attempt to exploit PHP session upload-progress handling and can be associated with PHP2Shell activity.
This combination may indicate an attempt to exploit PHP session upload-progress handling and can be associated with PHP2Shell activity.
This correlation analytic identifies likely PHP2Shell exploitation attempts by correlating a PHP memory disclosure indicator
with either of two independent PHP web exploitation indicators from Cisco Secure Firewall Threat Defense Intrusion Events.
Seeing these behaviors from the same source against the same destination within a short period can indicate an attempt to
improve the reliability of subsequent exploitation. Investigate the complete network and web server activity.
with either of two independent PHP web exploitation indicators from Cisco Secure Firewall Threat Defense Intrusion Events.
Seeing these behaviors from the same source against the same destination within a short period can indicate an attempt to
improve the reliability of subsequent exploitation. Investigate the complete network and web server activity.
This analytic detects Suricata multipart POST events with an uploaded filename containing a PHP opening tag.
Suricata EVE HTTP events do not expose multipart form field names, so this variant cannot confirm the PHPSESSID or PHP_SESSION_UPLOAD_PROGRESS fields without additional request-body inspection. The filename pattern may indicate an attempt to place executable PHP content into session-related data as part of PHP2Shell exploitation.
Suricata EVE HTTP events do not expose multipart form field names, so this variant cannot confirm the PHPSESSID or PHP_SESSION_UPLOAD_PROGRESS fields without additional request-body inspection. The filename pattern may indicate an attempt to place executable PHP content into session-related data as part of PHP2Shell exploitation.
This analytic detects multipart POST traffic with a serialized PHP structure in an uploaded filename, which may indicate an attempt to exploit PHP session upload-progress handling and can be associated with PHP2Shell activity.
Suricata EVE's standard HTTP events do not expose multipart form field names, so this Suricata variant cannot confirm the PHP_SESSION_UPLOAD_PROGRESS field without additional request-body inspection.
Suricata EVE's standard HTTP events do not expose multipart form field names, so this Suricata variant cannot confirm the PHP_SESSION_UPLOAD_PROGRESS field without additional request-body inspection.
Page 1 of 250