This anomaly rule detects multipart POST traffic where an uploaded filename contains a serialized PHP structure, which can indicate attempts to abuse PHP session upload progress handling and may be linked to PHP2Shell activity. It leverages Suricata EVE HTTP events and inspects fileinfo.filename to extract a serialized token via a regex that matches common PHP serialization patterns (for example O:, C:, a:, s:, E:, r:, i:, d:, b: tokens). When a token is found, the rule aggregates results by filename and relevant network HTTP metadata (source/destination IP and ports, URL, HTTP method, content type) to surface suspicious uploads. Note that Suricata EVE does not expose multipart form field names in standard HTTP events, so the rule cannot confirm the exact PHP_SESSION_UPLOAD_PROGRESS field without deeper request-body inspection; it is a heuristic signal rather than definitive proof. The rule is intended to help detect potential web-facing abuse and correlate to PHP2Shell activity, guiding further investigation and containment. Potential false positives include legitimate applications that use unusual filenames containing serialized-looking text. References to PHP2Shell and related CVEs are included, and the rule aligns with MITRE ATT&CK technique T1190 (Exploit Public-Facing Application). The detection is designed for Splunk deployments (Suricata TA) and emphasizes alerting on anomalous upload filename content rather than full payload verification.