Detects Suricata EVE HTTP multipart POST events where the uploaded filename contains a PHP opening tag, indicating potential inline PHP payloads in upload names (e.g., <?php or <?=). The Splunk search extracts a php_token from fileinfo.filename via a case-insensitive regex, filters events with a non-null token, and aggregates results by filename, source, destination, and HTTP metadata (URL, method, content type) with first/last event times. Alerts surface possible PHP2Shell exploitation attempts, noting that multipart form field names (e.g., PHPSESSID or PHP_SESSION_UPLOAD_PROGRESS) cannot be confirmed from the filename alone and would require request-body inspection. References include PHP2Shell, related CVEs, and MITRE technique T1190.