Detection: PHP Opening Tag in Upload Filename - Suricata

Created: 2026-10-23 Last Updated: 2026-10-28 ID: 79fe02c5-5ccd-4119-9d94-c3f8418fae2a Author: Raven Tait, Onur Mustafa Erdogan, Nasreddine Bencherchali, Splunk Type: Anomaly Product: Splunk Enterprise Security

Description

This analytic detects Suricata multipart POST events with an uploaded filename containing a PHP opening tag. Suricata EVE HTTP events do not expose multipart form field names, so this variant cannot confirm the PHPSESSID or PHP_SESSION_UPLOAD_PROGRESS fields without additional request-body inspection. The filename pattern may indicate an attempt to place executable PHP content into session-related data as part of PHP2Shell exploitation.

Search

 1`suricata`
 2http_method=POST
 3fileinfo.filename=*
 4
 5
 6| rex field=fileinfo.filename max_match=0 "(?i)(?<php_token>(?:<\\?php\\b
 7|<\\?=))"
 8
 9
10| where isnotnull(php_token)
11
12
13| rename dest_ip as dest,
14         src_ip as src
15
16
17| stats count min(_time) as firstTime
18              max(_time) as lastTime
19              values(php_token) as php_token
20              values(http_content_type) as http_content_type
21
22  by fileinfo.filename
23     src src_port
24     dest dest_port
25     url http_method
26
27
28| `security_content_ctime(firstTime)`
29
30| `security_content_ctime(lastTime)`
31
32| `php_opening_tag_in_upload_filename___suricata_filter`

Data Source

Name	Platform	Sourcetype	Source
Suricata	Network	`'suricata'`	`'not_applicable'`

Macros Used

Name	Value
security_content_ctime	`convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)`
php_opening_tag_in_upload_filename___suricata_filter	`search *`

php_opening_tag_in_upload_filename___suricata_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1190	Exploit Public-Facing Application	Initial Access

Delivery

DE.AE

CIS 13

CVE

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Finding (Notable)	No
Creates Intermediate Finding (Risk Event)	Yes

Anomaly detections generate Intermediate Findings (Risk Events). They do not generate a Finding (Notable) directly.

Implementation

Configure Suricata EVE JSON to emit HTTP and fileinfo events, and ingest the JSON with the Splunk TA for Suricata. Set the suricata macro to the TA's sourcetype (commonly sourcetype=suricata). Verify that POST file events expose http_method, fileinfo.filename, src_ip, src_port, dest_ip, dest_port, and the HTTP URL/content type fields used by the search. This rule matches PHP opening tags in the filename only; Suricata EVE does not provide the multipart form field names needed to verify PHPSESSID or PHP_SESSION_UPLOAD_PROGRESS.

Known False Positives

Security testing tools or development environments may upload files with PHP code in the filename. Review the request headers, destination application, and any follow-on requests or server-side execution evidence.

Associated Analytic Story

PHP2Shell

Intermediate Findings

Message	Entity Field	Entity Type	Risk Score
A POST request from [$src$] to [$dest$] included a PHP opening tag in an upload filename.	dest	system	40

Threat Objects

Field	Type
src	ip_address

References

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`not_applicable`	`suricata`
Integration	✅ Passing	Dataset	`not_applicable`	`suricata`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 1