title: Burst of Multipart POST Requests to PHP Endpoints
id: e2f4d5d5-3286-4f0c-96b3-a30246b776eb
status: experimental
description: |
    Base rule for the correlation below. Detects a POST with a multipart/form-data Content-Type to a .php URL in web server access logs.
    Needs the request Content-Type in the log (not in most default log formats; field cs-content-type needs a custom log format).
    Allowlist your real upload URLs with a filter before use. Tested offline on synthetic rows on 2026-10-22; on 2026-10-24 it fired on logs from real lab PHP containers (47 of 50 requests matched, 35 in the busiest minute against a threshold of 30), not on production traffic.
references:
    - https://cyray.io/attack-to-detection/t1190-php2shell-php-multipart-rce
author: CyRay
date: 2026-10-21
tags:
    - attack.initial-access
    - attack.t1190
logsource:
    category: webserver
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '.php'
        cs-content-type|startswith: 'multipart/form-data'
    condition: selection
falsepositives:
    - Legitimate upload forms and CMS admin pages (allowlist their URLs)
    - Load tests and monitoring that post forms
level: low
---
title: Burst of Multipart POST Requests to PHP Endpoints - Correlation
id: f7de57d4-8731-49bd-9ad7-1c5617e5a71c
status: experimental
description: |
    One source sending 30 or more multipart/form-data POSTs to .php endpoints within one minute. The threshold is a starting value, not measured.
    Context: PHP multipart handling flaws (php2shell), discussed publicly before the PHP fix of 2026-10-21. Tested offline on synthetic rows on 2026-10-22; on 2026-10-24 it fired on logs from real lab PHP containers (47 of 50 requests matched, 35 in the busiest minute against a threshold of 30), not on production traffic.
references:
    - https://cyray.io/attack-to-detection/t1190-php2shell-php-multipart-rce
author: CyRay
date: 2026-10-21
tags:
    - attack.initial-access
    - attack.t1190
correlation:
    type: event_count
    rules:
        - e2f4d5d5-3286-4f0c-96b3-a30246b776eb
    group-by:
        - c-ip
    timespan: 1m
    condition:
        gte: 30
falsepositives:
    - Bulk upload tools and scanners owned by the organisation
    - Load tests
level: medium