Cisco Secure Firewall - PHP2Shell Exploitation Attempt

name: Cisco Secure Firewall - PHP2Shell Exploitation Attempt
id: 9a6b3ab0-4549-459b-9f89-f753bf92a53f
version: 1
creation_date: '2026-10-28'
modification_date: '2026-10-28'
author: Splunk
status: production
type: TTP
description: |
    This correlation analytic identifies likely PHP2Shell exploitation attempts by correlating a PHP memory disclosure indicator
    with either of two independent PHP web exploitation indicators from Cisco Secure Firewall Threat Defense Intrusion Events.
    Seeing these behaviors from the same source against the same destination within a short period can indicate an attempt to
    improve the reliability of subsequent exploitation. Investigate the complete network and web server activity.
data_source:
    - Cisco Secure Firewall Threat Defense Intrusion Event
search: |
    `cisco_secure_firewall` EventType=IntrusionEvent SignatureID IN (67359, 67360, 67375)
    | bin _time span=5m
    | fillnull
    | stats dc(SignatureID) as unique_signature_count
            values(SignatureID) as SignatureID
            values(signature) as signature
            values(class_desc) as class_desc
            values(MitreAttackGroups) as MitreAttackGroups
            values(InlineResult) as InlineResult
            values(InlineResultReason) as InlineResultReason
            values(dest_port) as dest_port
            values(rule) as rule
            values(transport) as transport
            values(app) as app
            min(_time) as firstTime
            max(_time) as lastTime
            count(eval(SignatureID=67375)) as sig_memory_disclosure
            count(eval(SignatureID=67359)) as sig_serialized_activity
            count(eval(SignatureID=67360)) as sig_upload_activity
      by _time src dest
    | where sig_memory_disclosure >= 1 AND (sig_serialized_activity >= 1 OR sig_upload_activity >= 1)
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_secure_firewall___php2shell_exploitation_attempt_filter`
how_to_implement: |
    This search requires Cisco Secure Firewall Threat Defense logs with IntrusionEvent data.
    It uses the `cisco_secure_firewall` input macro, configure it for your environment (index, source, sourcetype).
    Ensure intrusion events are collected via the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404) and that the relevant intrusion policy is enabled.
known_false_positives: Security testing may trigger multiple related signatures. Review event timing, source, destination, and application context.
references:
    - https://www.php2shell.com/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-109618
    - https://nvd.nist.gov/vuln/detail/CVE-2026-109619
drilldown_searches:
    - name: View the detection results for - "$src$" and "$dest$"
      search: '%original_detection_search% | search src="$src$" dest="$dest$"'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
    - name: View risk events for the last 7 days for - "$dest$"
      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
      earliest_offset: 7d
      latest_offset: "0"
finding:
    title: PHP2Shell exploitation activity from [$src$] targeting [$dest$]
    entity:
        field: dest
        type: system
        score: 70
threat_objects:
    - field: signature
      type: signature
    - field: src
      type: ip_address
analytic_story:
    - Cisco Secure Firewall Threat Defense Analytics
    - PHP2Shell
asset_type: Network
cve:
    - CVE-2026-109618
    - CVE-2026-109619
mitre_attack_id:
    - T1190
product:
    - Splunk Enterprise
    - Splunk Cloud
    - Splunk Enterprise Security
category: network
security_domain: network
tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/emerging_threats/php2shell/cisco_sfw_intrusion_events.log
          source: not_applicable
          sourcetype: cisco:sfw:estreamer
      test_type: unit