Detection: PHP Memory Exhaustion Exploitation Attempt via Multipart Request

Created: 2026-10-22 Last Updated: 2026-10-22 ID: 53db8c3a-aea4-4eef-9cb4-a20c84b7f133 Author: Onur Mustafa Erdogan, Raven Tait, Nasreddine Bencherchali, Splunk Type: Anomaly Product: Splunk Enterprise Security

Description

This analytic correlates Apache and Nginx access and error logs when "multipart/form-data" requests and PHP memory-limit exhaustion errors occur for the same PID, host, and client. It extracts web request details and "PHP" error messages to support investigation of possible PHP2Shell exploitation attempts.

Search

 1(
 2    `apache_access_logs`
 3    OR
 4    `apache_error_logs`
 5    OR
 6    `nginx_access_logs`
 7    OR
 8    `nginx_error_logs`
 9)
10(
11    "multipart/form-data"
12    OR
13    (
14        "Allowed memory size of"
15        AND
16        "bytes exhausted"
17    )
18)
19
20
21| rex field=_raw "\[pid\s+(?<pid>\d+)"
22
23| rex field=_raw "\]\s+(?<pid>\d+)\#\d+\:"
24
25
26| rex field=_raw "client\:?\s+(?<client>.*?)(?:,
27|\]
28|$)"
29
30| rex mode=sed field=client "s/\:\d+$//g"
31
32
33| rex field=_raw "server\:\s+(?<server>.*?)(?:,\s
34|$)"
35
36
37| rex field=_raw "request\:\s+\"(?<method>\w+)\s+(?<uri>.*?)\s+HTTP\/\d+\.\d+\"(?:,\s
38|$)"
39
40
41| rex field=_raw "(?i)PHP(?:\s+\w+){1,}:\s+(?<error_message>.*?)$"
42
43
44| eval pid=coalesce(worker_pid,pid)
45
46| eval message=coalesce(error_message,message)
47
48| eval src=coalesce(client,src,src_ip)
49
50| eval dest=coalesce(server,dest,dest_ip)
51
52| eval http_method=coalesce(method,http_method)
53
54| eval http_content_length=coalesce(content_length,http_content_length)
55
56| eval http_content_type=coalesce(content_type,http_content_type)
57
58| eval http_user_agent=coalesce(user_agent,http_user_agent)
59
60| eval http_referrer=coalesce(referrer,http_referrer)
61
62
63| stats count min(_time) as firstTime last(_time) as lastTime
64    dc(source) as dc_source
65    values(source) as source
66    values(http_method) as http_method
67    values(dest) as dest
68    values(dest_port) as dest_port
69    values(site) as site
70    values(uri) as uri
71    values(status) as status
72    values(memory_bytes) as memory_bytes
73    values(http_content_length) as http_content_length
74    values(http_content_type) as http_content_type
75    values(http_referrer) as http_referrer
76    values(http_user_agent) as http_user_agent
77    values(message) as message
78    by pid host src
79
80| where mvfind(source,"access")>=0 AND mvfind(source,"error")>=0
81
82
83| `security_content_ctime(firstTime)`
84
85| `security_content_ctime(lastTime)`
86
87| `php_memory_exhaustion_exploitation_attempt_via_multipart_request_filter`

Data Source

Name	Platform	Sourcetype	Source
Nginx Error Log	Web	`'nginx:plus:error'`	`'/var/log/nginx/error.log'`
Nginx Access	Web	`'nginx:plus:kv'`	`'/var/log/nginx/access.log'`

Macros Used

Name	Value
security_content_ctime	`convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)`
php_memory_exhaustion_exploitation_attempt_via_multipart_request_filter	`search *`

php_memory_exhaustion_exploitation_attempt_via_multipart_request_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1190	Exploit Public-Facing Application	Initial Access

Delivery

DE.AE

CIS 13

CVE

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Finding (Notable)	No
Creates Intermediate Finding (Risk Event)	Yes

Anomaly detections generate Intermediate Findings (Risk Events). They do not generate a Finding (Notable) directly.

Implementation

Ingest Apache and/or Nginx access and error logs into Splunk. Configure the apache_access_logs and apache_error_logs or nginx_access_logs and nginx_error_logs macros with the corresponding source and sourcetype patterns. Ensure events contain host, source, PID, client, web request fields, and "PHP" error messages. The search groups events by PID, host, and client, and correlates access and error source types.

Known False Positives

Legitimate large multipart uploads, application bugs, or load tests can cause memory-limit errors. Review the correlated access and PHP error events before classifying this activity as exploitation.

Associated Analytic Story

PHP2Shell

Intermediate Findings

Message	Entity Field	Entity Type	Risk Score
PHP memory exhaustion exploitation attempt via multipart/form-data access was observed for PID [$pid$] on host [$dest$] from client [$src$].	pid	system	30

Threat Objects

Field	Type
uri	uri

References

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`/var/log/nginx/error.log`	`nginx:plus:error`
Integration	✅ Passing	Dataset	`/var/log/nginx/error.log`	`nginx:plus:error`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 1