Large HTTP POST Request Resulting in Server Error
Description
This analytic detects HTTP POST requests with a body of at least one megabyte that receive an HTTP 500 response. Large failed uploads can indicate attempts to trigger resource exhaustion or exploit vulnerable request handling, including behavior associated with PHP2Shell, but require investigation with related web and application logs.
Query · spl
`zeek_http`
method="POST"
status_code=500
| eval src=coalesce(src, src_ip, 'id.orig_h'),
dest=coalesce(dest, dest_ip, 'id.resp_h'),
dest_port=coalesce(dest_port, 'id.resp_p')
| eval body_bytes=coalesce(tonumber(request_body_len), len(post_body), 0)
| where body_bytes>=1000000
| stats count min(_time) as firstTime
max(_time) as lastTime
max(body_bytes) as body_bytes
values(user_agent) as user_agent
values(status_code) as status_code
by src dest dest_port uri
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `large_http_post_request_resulting_in_server_error_filter`
Implementation guide
Zeek HTTP logs must be ingested into Splunk using the latest version of Splunk Add-on for Zeek (https://splunkbase.splunk.com/app/5466).
The "post_body" field must be populated, which requires Zeek to be configured with the HTTP post body extraction policy.
Configure the zeek_http macro to match the sourcetype used by your Zeek add-on.
Known false positives
- Large legitimate uploads can fail because of application limits, timeouts, storage constraints, or transient server errors. Review the request URI, upload size, server logs, and client behavior before classifying the activity as malicious.
Analyst notes
Known false positives: Large legitimate uploads can fail because of application limits, timeouts, storage constraints, or transient server errors. Review the request URI, upload size, server logs, and client behavior before classifying the activity as malicious.