Detection: Serialized PHP Token in Upload Filename - Suricata

Created: 2026-10-23 Last Updated: 2026-10-28 ID: f5abaeab-eabd-4b8a-bc62-ec3d3722e4fe Author: Raven Tait, Onur Mustafa Erdogan, Nasreddine Bencherchali, Splunk Type: Anomaly Product: Splunk Enterprise Security

Description

This analytic detects multipart POST traffic with a serialized PHP structure in an uploaded filename, which may indicate an attempt to exploit PHP session upload-progress handling and can be associated with PHP2Shell activity. Suricata EVE's standard HTTP events do not expose multipart form field names, so this Suricata variant cannot confirm the PHP_SESSION_UPLOAD_PROGRESS field without additional request-body inspection.

Search

 1`suricata` http_method=POST fileinfo.filename=*
 2
 3| rex field=fileinfo.filename max_match=0 "(?i)(?<serialization_token>\
 4|?O:\d+:
 5|C:\d+:
 6|a:\d+:\{
 7|[sS]:\d+:
 8|E:\d+:
 9|[rR]:\d+;
10|i:-?\d+;
11|d:(?:[-+]?(?:\d+(?:\.\d*)?
12|\.\d+)(?:[eE][-+]?\d+)?
13|INF
14|NAN);
15|b:[01];
16|N;)"
17
18| where isnotnull(serialization_token)
19
20| rename dest_ip as dest
21
22| rename src_ip as src
23
24| stats count min(_time) as firstTime max(_time) as lastTime values(serialization_token) as serialization_tokens values(http_content_type) as http_content_type by fileinfo.filename, src, src_port, dest, dest_port, url, http_method
25
26| `security_content_ctime(firstTime)`
27
28| `security_content_ctime(lastTime)`
29
30| `serialized_php_token_in_upload_filename___suricata_filter`

Data Source

Name	Platform	Sourcetype	Source
Suricata	Network	`'suricata'`	`'not_applicable'`

Macros Used

Name	Value
suricata	`sourcetype=suricata`
serialized_php_token_in_upload_filename___suricata_filter	`search *`

serialized_php_token_in_upload_filename___suricata_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1190	Exploit Public-Facing Application	Initial Access

Delivery

DE.AE

CIS 13

CVE

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Finding (Notable)	No
Creates Intermediate Finding (Risk Event)	Yes

Anomaly detections generate Intermediate Findings (Risk Events). They do not generate a Finding (Notable) directly.

Implementation

Configure Suricata EVE JSON to emit HTTP and fileinfo events, and ingest the JSON with the Splunk TA for Suricata. Set the suricata macro to the TA's sourcetype (commonly sourcetype=suricata). Verify that POST file events expose http_method, fileinfo.filename, src_ip, src_port, dest_ip, dest_port, and the HTTP URL/content type fields used by the search. This rule matches serialized PHP tokens in the filename only; Suricata EVE does not provide multipart form field names, so it cannot verify PHP_SESSION_UPLOAD_PROGRESS.

Known False Positives

Applications may upload files with names containing serialized-looking text as part of testing or unusual workflows. Review the filename, source, destination, and application context before determining intent.

Associated Analytic Story

PHP2Shell

Intermediate Findings

Message	Entity Field	Entity Type	Risk Score
A POST request from [$src$] to [$dest$] included a serialized PHP structure in an upload filename.	dest	system	40

Threat Objects

Field	Type
src	ip_address

References

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`not_applicable`	`suricata`
Integration	✅ Passing	Dataset	`not_applicable`	`suricata`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 1