PHP File Upload

Alert ID: php_upload MITRE ATT&CK: T1505.003 – Server Software Component: Web Shell

Severity / Criticality

!!! danger “Critical” Any PHP file detected inside the uploads directory is considered a serious threat.

Why is it considered malicious?

Web shells: allow remote command execution on the server.
Backdoors: give the attacker persistent access.
Cryptominers: use server resources without authorization.
Spam mailers: turn the site into a bulk spam platform.
Data exfiltration: theft of sensitive information.

!!! warning "" The uploads directory must not contain executable code under any circumstances.

When does the alert trigger?

Immediate detection of suspicious extensions: .php, .php3, .php4, .php5, .phtml, .phar.
Other monitored extensions:
- Scripts: .asp, .aspx, .jsp, .cgi, .pl, .py, .rb.
- Executables: .exe, .dll, .bat, .sh, .ps1.
Content analysis: PHP indicators such as <?php, <?=.
Deduplication window: 30 seconds.

Technical Indicators (IOCs)

Type	Pattern	Description
`file_pattern`	`eval($_POST['cmd']);`	Remote code execution
`file_pattern`	`system($_GET['command']);`	System command execution
`file_pattern`	`base64_decode(`	Obfuscated code
`file_pattern`	`file_get_contents('php://input')`	Direct read from PHP input
`file_pattern`	`c99.php, r57.php, wso.php`	Known web shells

Common false positives

Poorly designed legitimate plugins that allow PHP uploads.
Developers uploading test code, which is bad practice.
Migration or backup tools that do not use temporary directories.

!!! warning “Attention” Even “false positives” represent serious security weaknesses that must be fixed.

Investigation steps

Do not execute the file. Inspect it with:

strings /path/to/file.php | grep -E 'eval|exec|system|base64'

Calculate the file’s MD5 and SHA256 hashes.
Verify origin through timestamp and access logs (user/IP).

Search for other shells:

find wp-content/uploads -name "*.php" -type f

Review logs for requests targeting the suspicious file.

Recommended mitigations

=== “Immediate”

!!! danger ""
    - Isolate the file; do not delete it if you need evidence.
    - Move it to a quarantine directory outside the `webroot`.
    - Block access through `.htaccess`.
    - Scan the full site with antimalware tools.
    - Change all passwords: WordPress, hosting, FTP, and database.

=== “Preventive”

!!! tip ""
    Add inside `wp-content/uploads/.htaccess`:

    ```apache
    <FilesMatch "\.(?:php|phtml)$">
    Deny from all
    </FilesMatch>
    ```

    - Restrict upload policies to images and documents only.
    - Validate files server-side before storing them.
    - Implement `mod_security` with web-shell detection rules.
    - Use safe permissions: 755 for upload folders, 644 for files.