Technical summary: This correlation analytic detects likely PHP2Shell exploitation attempts by correlating a PHP memory disclosure indicator with either of two independent PHP web exploitation indicators from Cisco Secure Firewall Threat Defense Intrusion Events. It scans for EventType IntrusionEvent with SignatureID in (67359, 67360, 67375) and aggregates results in 5-minute bins, grouped by source and destination. The search computes contextual fields (signature, class_desc, MitreAttackGroups, InlineResult, InlineResultReason, dest_port, rule, transport, app) and counts: sig_memory_disclosure (SignatureID=67375), sig_serialized_activity (SignatureID=67359), and sig_upload_activity (SignatureID=67360). It then filters to require at least one memory disclosure and at least one of the other two indicators for the same source-destination pair within the window. The finding is titled "PHP2Shell exploitation activity from [$src$] targeting [$dest$]" and maps to CVEs CVE-2026-109618/109619 and MITRE technique T1190 (Exploitation of Public-Facing Application). Drilldowns support viewing per-src/dest detection results and related risk events. The rule is intended to reduce false positives by requiring multiple corroborating signals, though security testing may trigger related signatures. To implement, ensure Cisco Threat Defense Intrusion Event logs are ingested (via the Splunk Add-on for Cisco Security Cloud and the appropriate input macro) and configure the related detection macros. When investigating, review full network and web server activity for the involved src and dest across the time window. This rule is designed for network protection and aligns with a network threat model, focusing on PHP2Shell exploitation indicators that traverse firewall boundaries.