Detection: Large HTTP POST Request Resulting in Server Error

Created: 2026-10-22 Last Updated: 2026-10-22 ID: 284ab19f-15f6-4f1c-9a4d-9f331438e37d Author: Raven Tait, Onur Mustafa Erdogan, Nasreddine Bencherchali, Splunk Type: Anomaly Product: Splunk Enterprise Security

Description

This analytic detects HTTP POST requests with a body of at least one megabyte that receive an HTTP 500 response. Large failed uploads can indicate attempts to trigger resource exhaustion or exploit vulnerable request handling, including behavior associated with PHP2Shell, but require investigation with related web and application logs.

Search

 1`zeek_http`
 2method="POST"
 3status_code=500
 4
 5
 6| eval src=coalesce(src, src_ip, 'id.orig_h'),
 7       dest=coalesce(dest, dest_ip, 'id.resp_h'),
 8       dest_port=coalesce(dest_port, 'id.resp_p')
 9
10
11| eval body_bytes=coalesce(tonumber(request_body_len), len(post_body), 0)
12
13
14| where body_bytes>=1000000
15
16
17| stats count min(_time) as firstTime
18              max(_time) as lastTime
19              max(body_bytes) as body_bytes
20              values(user_agent) as user_agent
21              values(status_code) as status_code
22
23  by src dest dest_port uri
24
25
26| `security_content_ctime(firstTime)`
27
28| `security_content_ctime(lastTime)`
29
30| `large_http_post_request_resulting_in_server_error_filter`

Data Source

Name	Platform	Sourcetype	Source
Zeek HTTP	Web	`'zeek:http'`	`'http.log'`

Macros Used

Name	Value
zeek_http	`sourcetype="zeek:http"`
large_http_post_request_resulting_in_server_error_filter	`search *`

large_http_post_request_resulting_in_server_error_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1190	Exploit Public-Facing Application	Initial Access

Delivery

DE.AE

CIS 13

CVE

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Finding (Notable)	No
Creates Intermediate Finding (Risk Event)	Yes

Anomaly detections generate Intermediate Findings (Risk Events). They do not generate a Finding (Notable) directly.

Implementation

Zeek HTTP logs must be ingested into Splunk using the latest version of Splunk Add-on for Zeek (https://splunkbase.splunk.com/app/5466). The "post_body" field must be populated, which requires Zeek to be configured with the HTTP post body extraction policy. Configure the zeek_http macro to match the sourcetype used by your Zeek add-on.

Known False Positives

Large legitimate uploads can fail because of application limits, timeouts, storage constraints, or transient server errors. Review the request URI, upload size, server logs, and client behavior before classifying the activity as malicious.

Associated Analytic Story

PHP2Shell

Intermediate Findings

Message	Entity Field	Entity Type	Risk Score
A large HTTP POST request of [$body_bytes$] bytes from [$src$] to [$dest$] received an HTTP 500 response.	dest	system	20

Threat Objects

Field	Type
src	ip_address

References

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`http.log`	`zeek:http`
Integration	✅ Passing	Dataset	`http.log`	`zeek:http`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 1