This detection identifies unusually large HTTP POST requests (body size >= 1 MB) that result in HTTP 500 server errors. Such patterns can indicate attempts to trigger resource exhaustion or exploit vulnerable request handling in web applications, including activity associated with PHP2Shell, and should be investigated with related web/app logs. The rule ingests Zeek HTTP logs via the Zeek HTTP data source, calculating body_bytes from request_body_len or post_body. It filters for body_bytes >= 1,000,000, then aggregates results by source (src), destination (dest), destination port (dest_port), and URI to surface per-endpoint activity. The analytic outputs include firstTime and lastTime, the largest observed body_bytes, and associated user_agent and status_code values, aided by the large_http_post_request_resulting_in_server_error_filter macro. The intermediate findings highlight a large POST from a source IP to a destination, triggering an HTTP 500 response. The rule’s threat model targets Web Application assets, with the threat object being the source IP. The analytic_story centers on PHP2Shell activity, and the rule references CVEs CVE-2026-109618 and CVE-2026-109619, as well as MITRE ATT&CK technique T1190 (Exploitation of Public-Facing Application). It is compatible with Splunk Enterprise, Splunk Enterprise Security, and Splunk Cloud, and is categorized under web security with a network-oriented security_domain. A True Positive test is provided, using a Zeek HTTP sample dataset to validate detection behavior. The rule is complemented by references to PHP2Shell resources and Zeek HTTP logs documentation. Potential impact includes resource exhaustion and application-layer abuse, so results should be correlated with request URIs, upload sizes, server logs, and client behavior before assigning malicious intent.