Detection: Large HTTP POST Request Resulting in Server Error

Created: 2026-10-22 Last Updated: 2026-10-28 ID: 284ab19f-15f6-4f1c-9a4d-9f331438e37d Author: Raven Tait, Onur Mustafa Erdogan, Nasreddine Bencherchali, Splunk Type: Anomaly Product: Splunk Enterprise Security

Description

This analytic detects HTTP POST requests with a body of at least one megabyte that receive an HTTP 500 response or cause a server crash. Large failed uploads can indicate attempts to trigger resource exhaustion or exploit vulnerable request handling, including behavior associated with PHP2Shell, but require investigation with related web and application logs.

Search

 1`zeek_http`
 2method="POST"
 3(status_code=500 OR NOT status_code=*)
 4
 5
 6| eval src=coalesce(src, src_ip, 'id.orig_h'),
 7       dest=coalesce(dest, dest_ip, 'id.resp_h'),
 8       dest_port=coalesce(dest_port, 'id.resp_p')
 9
10
11| eval body_bytes=coalesce(tonumber(request_body_len), len(post_body), 0)
12
13
14| where body_bytes>=1000000
15
16
17| stats count min(_time) as firstTime
18              max(_time) as lastTime
19              max(body_bytes) as body_bytes
20              values(user_agent) as user_agent
21              values(status_code) as status_code
22
23  by src dest dest_port uri
24
25
26| `security_content_ctime(firstTime)`
27
28| `security_content_ctime(lastTime)`
29
30| `large_http_post_request_resulting_in_server_error_filter`

Data Source

Name	Platform	Sourcetype	Source
Zeek HTTP	Web	`'zeek:http'`	`'http.log'`

Macros Used

Name	Value
security_content_ctime	`convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)`
large_http_post_request_resulting_in_server_error_filter	`search *`

large_http_post_request_resulting_in_server_error_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1190	Exploit Public-Facing Application	Initial Access

Delivery

DE.AE

CIS 13

CVE

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Finding (Notable)	No
Creates Intermediate Finding (Risk Event)	Yes

Anomaly detections generate Intermediate Findings (Risk Events). They do not generate a Finding (Notable) directly.

Implementation

Ingest Zeek http.log with the TA for Zeek (https://splunkbase.splunk.com/app/5466), then set the zeek_http macro to select that data (the search expects sourcetype zeek:http by default). Ensure each record contains method, status_code, request_body_len, uri, and endpoint fields such as id.orig_h/id.resp_h and id.resp_p (or the equivalent src/dest fields).

Known False Positives

Large legitimate uploads can fail because of application limits, timeouts, storage constraints, or transient server errors. Review the request URI, upload size, server logs, and client behavior before classifying the activity as malicious.

Associated Analytic Story

Intermediate Findings

Message	Entity Field	Entity Type	Risk Score
A large HTTP POST request of [$body_bytes$] bytes from [$src$] to [$dest$] caused a server error.	dest	system	20

Threat Objects

Field	Type
src	ip_address

References

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`http.log`	`zeek:http`
Integration	✅ Passing	Dataset	`http.log`	`zeek:http`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 2