Techniques
Sample rules
Inline PHP Code Execution
- source: splunk
- technicques:
Description
The following analytic detects PHP command-line interpreters executing code supplied directly on the command line with the CLI -r / –run options, or code supplied to PHPDBG through standard input. It covers common CLI executable names on Linux and Windows, including php.exe, php-win.exe, the legacy php-cli.exe name, versioned Linux php binaries, phpdbg, and FrankenPHP’s php-cli subcommand. PHP-CGI and PHP-FPM are excluded because they do not support the PHP CLI inline -r option. This behavior can be used legitimately for administration and automation, but unexpected or obfuscated inline PHP execution may indicate an attacker using an installed interpreter to run commands without dropping a script file.
Detection logic
| tstats `security_content_summariesonly`
count min(_time) as firstTime
max(_time) as lastTime
FROM datamodel=Endpoint.Processes WHERE
(
(
Processes.process_name IN (
"php-cli.exe",
"php-win.exe",
"php.exe",
"php",
"php5*",
"php7*",
"php8*",
"php9*",
)
Processes.process IN ("* -r *", "* --run *", "* --run=*")
NOT Processes.process_name IN ("*cgi*", "*fpm*")
)
OR
(
Processes.process_name IN ("phpdbg", "phpdbg.exe")
Processes.process IN ("* -s", "* -s ", "* -s=*")
)
OR
(
Processes.process_name IN ("frankenphp", "frankenphp.exe")
Processes.process= "*php-cli*"
Processes.process= "* -r *"
)
)
by Processes.action Processes.dest Processes.original_file_name
Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
Processes.process Processes.process_exec Processes.process_guid
Processes.process_hash Processes.process_id Processes.process_integrity_level
Processes.process_name Processes.process_path Processes.user
Processes.user_id Processes.vendor_product
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `inline_php_code_execution_filter`