Large HTTP POST Request Failure or Missing Response - Suricata
Description
This analytic detects HTTP POST requests with a declared body size of at least one megabyte that receive an HTTP 500 response or have no response status recorded. Large failed or unanswered uploads can indicate attempts to trigger resource exhaustion or exploit vulnerable request handling, including behavior associated with PHP2Shell, but require investigation with related web and application logs.
Query · spl
`suricata`
event_type=http
http_method=POST
| spath input=_raw path=http.status output=response_status
| spath input=_raw path=http.request_headers{}.name output=request_header_names
| spath input=_raw path=http.request_headers{}.value output=request_header_values
| eval request_header=mvzip(request_header_names, request_header_values, "|||")
| mvexpand request_header
| rex field=request_header "(?i)^Content-Length\\|\\|\\|(?<request_bytes>\\d+)$"
| eval request_bytes=tonumber(request_bytes),
response_status=tonumber(response_status),
status_code=if(isnull(response_status), "missing", tostring(response_status))
| where request_bytes>=1000000 AND (response_status=500 OR isnull(response_status))
| eval src=coalesce(src, src_ip), dest=coalesce(dest, dest_ip), uri=coalesce(url, 'http.url')
| stats count min(_time) as firstTime
max(_time) as lastTime
max(request_bytes) as request_bytes
values(status_code) as status_code
values(http_user_agent) as http_user_agent
by src dest dest_port uri http_method
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `large_http_post_request_failure_or_missing_response___suricata_filter`
Implementation guide
Configure Suricata EVE JSON HTTP logging with extended: yes and dump-all-headers: both under the EVE
http type, then ingest the JSON with the Splunk TA for Suricata. Set the suricata macro to the TA's
sourcetype (commonly sourcetype=suricata). The search requires event_type=http, http_method, and
http.request_headers name/value pairs so it can read Content-Length; http.status may be absent for
requests without a response. Verify that the TA extracts the nested EVE fields used by this search.
Known false positives
- Large legitimate uploads can fail because of application limits, timeouts, storage constraints, transient server errors, or network interruptions that prevent a response from being recorded. Review the request URI, declared upload size, server logs, and client behavior before classifying the activity as malicious.
Analyst notes
Known false positives: Large legitimate uploads can fail because of application limits, timeouts, storage constraints, transient server errors, or network interruptions that prevent a response from being recorded. Review the request URI, declared upload size, server logs, and client behavior before classifying the activity as malicious.