Sunturai
Back to results
InformationalSplunk security contentRaven Tait +3

Linux Auditd Inline PHP Code Execution

The following analytic detects PHP command-line interpreters executing code supplied directly on the command line with CLI code-execution options such as -r / --run and -B / -R / -E / -F, or PHP runtime INI overrides…

Description

The following analytic detects PHP command-line interpreters executing code supplied directly on the command line with CLI code-execution options such as -r / --run and -B / -R / -E / -F, or PHP runtime INI overrides that can load code. It also detects code supplied to PHPDBG through the -s option and FrankenPHP php-cli execution. It covers common Linux CLI executable names, including php, versioned PHP binaries, phpdbg, and FrankenPHP. PHP-CGI and PHP-FPM are excluded from the CLI option branch because they do not support the PHP CLI inline -r option. This behavior can be used legitimately for administration and automation, but unexpected or obfuscated inline PHP execution may indicate an attacker using an installed interpreter to run commands without dropping a script file.

Detection logic

Detection requirements

Platform
ContainersESXiIaaSIdentity ProviderLinuxmacOSNetwork DevicesOffice SuiteSaaSWindows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source category
linux_auditd_execve

Known benign triggers

  • Developers and administrators may use PHP CLI or PHPDBG for legitimate automation and troubleshooting. Review the command line, parent process, user, host, and execution context. Tune approved automation by host or parent process as needed.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice