Sunturai
Back to results
LowSplunk security contentRaven Tait +3

PHP Opening Tag in Upload Filename - Suricata

This analytic detects Suricata multipart POST events with an uploaded filename containing a PHP opening tag. Suricata EVE HTTP events do not expose multipart form field names, so this variant cannot confirm the…

Description

This analytic detects Suricata multipart POST events with an uploaded filename containing a PHP opening tag. Suricata EVE HTTP events do not expose multipart form field names, so this variant cannot confirm the PHPSESSID or PHP_SESSION_UPLOAD_PROGRESS fields without additional request-body inspection. The filename pattern may indicate an attempt to place executable PHP content into session-related data as part of PHP2Shell exploitation.

Detection logic

Detection requirements

Platform
ContainersESXiIaaSLinuxmacOSNetwork DevicesWindows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source category
suricata

Known benign triggers

  • Security testing tools or development environments may upload files with PHP code in the filename. Review the request headers, destination application, and any follow-on requests or server-side execution evidence.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice