From b366dcba50746f7407e8e49c34f225b8448f4abd Mon Sep 17 00:00:00 2001 From: nasbench Date: Thu, 22 Oct 2026 19:47:45 +0200 Subject: [PATCH 1/3] Add php2shell attack datasets --- .../php2shell/inline_php_exec_linux.log | 3 ++ .../php2shell/inline_php_exec_windows.log | 3 ++ .../php2shell/memory_exhaustion_access.log | 3 ++ .../php2shell/memory_exhaustion_error.log | 3 ++ .../emerging_threats/php2shell/php2shell.yml | 38 +++++++++++++++++++ .../php2shell/php_tag_filename.log | 3 ++ .../php2shell/php_upload_progress.log | 3 ++ .../php2shell/zeek_large_post_body.log | 3 ++ 8 files changed, 59 insertions(+) create mode 100644 datasets/emerging_threats/php2shell/inline_php_exec_linux.log create mode 100644 datasets/emerging_threats/php2shell/inline_php_exec_windows.log create mode 100644 datasets/emerging_threats/php2shell/memory_exhaustion_access.log create mode 100644 datasets/emerging_threats/php2shell/memory_exhaustion_error.log create mode 100644 datasets/emerging_threats/php2shell/php2shell.yml create mode 100644 datasets/emerging_threats/php2shell/php_tag_filename.log create mode 100644 datasets/emerging_threats/php2shell/php_upload_progress.log create mode 100644 datasets/emerging_threats/php2shell/zeek_large_post_body.log diff --git a/datasets/emerging_threats/php2shell/inline_php_exec_linux.log b/datasets/emerging_threats/php2shell/inline_php_exec_linux.log new file mode 100644 index 00000000..b02d96e8 --- /dev/null +++ b/datasets/emerging_threats/php2shell/inline_php_exec_linux.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:3951def23b99e340f7e011d86543d75835ce6e67f45b31e311ba046bc9eb0d79 +size 7392 diff --git a/datasets/emerging_threats/php2shell/inline_php_exec_windows.log b/datasets/emerging_threats/php2shell/inline_php_exec_windows.log new file mode 100644 index 00000000..2f283210 --- /dev/null +++ b/datasets/emerging_threats/php2shell/inline_php_exec_windows.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:42d2407098516b802399dc4afdf6bc361bd697908a2129cdc85fb185d83e1c31 +size 9649 diff --git a/datasets/emerging_threats/php2shell/memory_exhaustion_access.log b/datasets/emerging_threats/php2shell/memory_exhaustion_access.log new file mode 100644 index 00000000..a145df41 --- /dev/null +++ b/datasets/emerging_threats/php2shell/memory_exhaustion_access.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:4cdda0415dcdf2ff08a5738fce7aed866fd42be1d5d87222fe1942ec30dfd76d +size 475 diff --git a/datasets/emerging_threats/php2shell/memory_exhaustion_error.log b/datasets/emerging_threats/php2shell/memory_exhaustion_error.log new file mode 100644 index 00000000..93c7201c --- /dev/null +++ b/datasets/emerging_threats/php2shell/memory_exhaustion_error.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:4c50718802e247417b411345e2f6510431dda8ca4e5c2c473705a29ba4b39e4e +size 241 diff --git a/datasets/emerging_threats/php2shell/php2shell.yml b/datasets/emerging_threats/php2shell/php2shell.yml new file mode 100644 index 00000000..6d419a88 --- /dev/null +++ b/datasets/emerging_threats/php2shell/php2shell.yml @@ -0,0 +1,38 @@ +author: Nasreddine Bencherchali, Raven Tait, Onur Erdogan, Splunk +id: 5e87fcdc-11e9-4a77-ab46-99ab4594482d +date: '2026-10-22' +description: Generated datasets for PHP inline code execution using php2shell. +environment: NA +directory: php2shell +mitre_technique: +- T1059.003 +- T1059.004 +datasets: +- name: inline_php_exec_linux + path: /datasets/emerging_threats/php2shell/inline_php_exec_linux.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational +- name: inline_php_exec_windows + path: /datasets/emerging_threats/php2shell/inline_php_exec_windows.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: php_upload_progress + path: /datasets/emerging_threats/php2shell/php_upload_progress.log + sourcetype: zeek:http + source: http.log +- name: memory_exhaustion_access + path: /datasets/emerging_threats/php2shell/memory_exhaustion_access.log + sourcetype: nginx:plus:kv + source: /var/log/nginx/ +- name: memory_exhaustion_error + path: /datasets/emerging_threats/php2shell/memory_exhaustion_error.log + sourcetype: nginx:plus:kv + source: /var/log/nginx/ +- name: php_tag_filename + path: /datasets/emerging_threats/php2shell/php_tag_filename.log + sourcetype: zeek:http + source: http.log +- name: zeek_large_post_body + path: /datasets/emerging_threats/php2shell/zeek_large_post_body.log + sourcetype: zeek:http + source: http.log diff --git a/datasets/emerging_threats/php2shell/php_tag_filename.log b/datasets/emerging_threats/php2shell/php_tag_filename.log new file mode 100644 index 00000000..df736726 --- /dev/null +++ b/datasets/emerging_threats/php2shell/php_tag_filename.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:463b7c2b58d268c96c74ffa44c1f5a535034679c5ee03a14f9352e375b786b94 +size 1366 diff --git a/datasets/emerging_threats/php2shell/php_upload_progress.log b/datasets/emerging_threats/php2shell/php_upload_progress.log new file mode 100644 index 00000000..3af259eb --- /dev/null +++ b/datasets/emerging_threats/php2shell/php_upload_progress.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:d6090c6f20171a0b35e9cb7de3a8611aba1a2529af69a370387857bb67144d9a +size 1349 diff --git a/datasets/emerging_threats/php2shell/zeek_large_post_body.log b/datasets/emerging_threats/php2shell/zeek_large_post_body.log new file mode 100644 index 00000000..926dd703 --- /dev/null +++ b/datasets/emerging_threats/php2shell/zeek_large_post_body.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:65017a0453abfaf1d860ce05459bf356db66e968361327776b2bc41f13b9e553 +size 256459 From 7d79ab4496926f2eff1923aa058555d4ed73e319 Mon Sep 17 00:00:00 2001 From: onurmerdogan Date: Thu, 22 Oct 2026 19:53:59 +0200 Subject: [PATCH 2/3] re-uploaded nginx logs --- .../emerging_threats/php2shell/memory_exhaustion_access.log | 4 ++-- .../emerging_threats/php2shell/memory_exhaustion_error.log | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/datasets/emerging_threats/php2shell/memory_exhaustion_access.log b/datasets/emerging_threats/php2shell/memory_exhaustion_access.log index a145df41..def9f7e6 100644 --- a/datasets/emerging_threats/php2shell/memory_exhaustion_access.log +++ b/datasets/emerging_threats/php2shell/memory_exhaustion_access.log @@ -1,3 +1,3 @@ version https://git-lfs.github.com/spec/v1 -oid sha256:4cdda0415dcdf2ff08a5738fce7aed866fd42be1d5d87222fe1942ec30dfd76d -size 475 +oid sha256:8bca593f23667f4dc4bc312c1e694271480594a8e3b4123f19b897fcaf1d5ed0 +size 70338 diff --git a/datasets/emerging_threats/php2shell/memory_exhaustion_error.log b/datasets/emerging_threats/php2shell/memory_exhaustion_error.log index 93c7201c..93216b19 100644 --- a/datasets/emerging_threats/php2shell/memory_exhaustion_error.log +++ b/datasets/emerging_threats/php2shell/memory_exhaustion_error.log @@ -1,3 +1,3 @@ version https://git-lfs.github.com/spec/v1 -oid sha256:4c50718802e247417b411345e2f6510431dda8ca4e5c2c473705a29ba4b39e4e -size 241 +oid sha256:32053c0f9326f6e3bb37e893f63de7c009146b9deef8885f3a3a2a12f0319794 +size 37424 From 5bc3542acc35c2d319a30324e4b80e95d029de4f Mon Sep 17 00:00:00 2001 From: nasbench Date: Thu, 22 Oct 2026 19:55:42 +0200 Subject: [PATCH 3/3] update source --- datasets/emerging_threats/php2shell/php2shell.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/datasets/emerging_threats/php2shell/php2shell.yml b/datasets/emerging_threats/php2shell/php2shell.yml index 6d419a88..14721645 100644 --- a/datasets/emerging_threats/php2shell/php2shell.yml +++ b/datasets/emerging_threats/php2shell/php2shell.yml @@ -23,11 +23,11 @@ datasets: - name: memory_exhaustion_access path: /datasets/emerging_threats/php2shell/memory_exhaustion_access.log sourcetype: nginx:plus:kv - source: /var/log/nginx/ + source: /var/log/nginx/access.log - name: memory_exhaustion_error path: /datasets/emerging_threats/php2shell/memory_exhaustion_error.log sourcetype: nginx:plus:kv - source: /var/log/nginx/ + source: /var/log/nginx/error.log - name: php_tag_filename path: /datasets/emerging_threats/php2shell/php_tag_filename.log sourcetype: zeek:http