Sunturai
Back to results
LowSplunk security contentRaven Tait +3

PHP Session Upload Progress Serialized Payload in Upload Filename

This analytic detects multipart POST requests containing the "PHP_SESSION_UPLOAD_PROGRESS" form field and a serialized PHP structure in an uploaded filename. This combination may indicate an attempt to exploit PHP…

Description

This analytic detects multipart POST requests containing the "PHP_SESSION_UPLOAD_PROGRESS" form field and a serialized PHP structure in an uploaded filename. This combination may indicate an attempt to exploit PHP session upload-progress handling and can be associated with PHP2Shell activity.

Detection logic

Detection requirements

Platform
ContainersESXiIaaSLinuxmacOSNetwork DevicesWindows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source category
zeek_http

Known benign triggers

  • Applications may upload files with names containing serialized-looking text as part of testing or unusual workflows. Review the complete request headers, source, destination, and application context before determining intent.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice