Sunturai
Back to results
HighSplunk security contentSplunk

Cisco Secure Firewall - PHP2Shell Exploitation Attempt

This correlation analytic identifies likely PHP2Shell exploitation attempts by correlating a PHP memory disclosure indicator with either of two independent PHP web exploitation indicators from Cisco Secure Firewall…

Description

This correlation analytic identifies likely PHP2Shell exploitation attempts by correlating a PHP memory disclosure indicator with either of two independent PHP web exploitation indicators from Cisco Secure Firewall Threat Defense Intrusion Events. Seeing these behaviors from the same source against the same destination within a short period can indicate an attempt to improve the reliability of subsequent exploitation. Investigate the complete network and web server activity.

Detection logic

Detection requirements

Platform
ContainersESXiIaaSLinuxmacOSNetwork DevicesWindows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source category
cisco_secure_firewall_threat_defense_intrusion_event

Known benign triggers

  • Security testing may trigger multiple related signatures. Review event timing, source, destination, and application context.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice