🚀 Key Highlights
ESCU 6.9.2 builds on the out-of-band PHP2Shell coverage introduced in ESCU 6.9.1, adding network detections for Suricata and Cisco Secure Firewall.
Please also review the ESCU 6.9.0 Release Notes for additional changes, announcements of deprecated detections, and upcoming changes to ESCU's Supported Splunk Platform versions
🌐 Added Suricata PHP2Shell detections 🌐
Added analytics for large HTTP POST requests that receive an HTTP 500 response or have no response status, PHP opening tags in upload filenames, and serialized PHP tokens in upload filenames.
🛡️ Added Cisco Secure Firewall coverage 🛡️
Added three analytics based on Threat Defense Intrusion Events: one detects serialized payload activity, one identifies suspicious upload activity, and one correlates multiple PHP2Shell-related intrusion indicators against the same destination.
📋 Improved Apache data source support 📋
Updated the Apache access and error data sources with Splunk Add-on for Apache Web Server fields and supported sourcetypes. Expanded the Apache macros to recognize the supported sourcetypes, with apache:access:combined identified as the currently supported access format for the detection.
🔧 Clarified multipart detection requirements 🔧
Updated the PHP memory exhaustion analytic’s implementation guidance and field handling for Apache TA data, including process IDs and URI fields. Updated related Zeek analytics with clearer requirements for sourcetype configuration and multipart request headers.
💻 Refined endpoint process detections 💻
Expanded inline PHP execution coverage and added false-positive filters. Updated web and application server child-process detections and shell macros to cover more server processes, shell variants, and renamed Windows shell binaries.
New Analytics - [6]
- Cisco Secure Firewall - PHP2Shell Exploitation Attempt
- Cisco Secure Firewall - PHP2Shell Serialized Payload Activity
- Cisco Secure Firewall - PHP2Shell Suspicious Upload Activity
- Large HTTP POST Request Failure or Missing Response - Suricata
- PHP Opening Tag in Upload Filename - Suricata
- Serialized PHP Token in Upload Filename - Suricata
Updated Analytics - [7]
- Inline PHP Code Execution
- Large HTTP POST Request Resulting in Server Error
- PHP Memory Exhaustion Exploitation Attempt via Multipart Request
- PHP Session Upload Progress Serialized Payload in Upload Filename
- PHP Session Upload Progress with PHP Code in Upload Filename
- Web or Application Server Spawning a Shell
- Windows Suspicious Child Process Spawned From WebServer
Other Updates
🪟 Updated Windows shell macro: Removed wscript.exe, cscript.exe, and mshta.exe to reduce unrelated matches. Added original_file_name checks for Command Prompt, Windows PowerShell, PowerShell ISE, and PowerShell 7 so renamed shell binaries remain detectable.
🐧 Expanded Linux shell macro: Added ash and mksh to cover additional shell variants used in Alpine and BusyBox environments.
📋 Expanded Apache log macros: Updated apache_access_logs to recognize the Apache TA sourcetypes, including apache:access:combined, apache:access:kv, apache:access:json, and apache:access, plus access_combined. Updated apache_error_logs to recognize apache:error and apache_error. The access detection currently supports apache:access:combined.