LoFP LoFP / new deployments, application defects, dependency changes, resource exhaustion, and configuration errors can legitimately produce a first-seen php fatal error.

Techniques

Sample rules

First Occurrence of a PHP Fatal Error on a Web Server

Description

This rule identifies the first PHP fatal error observed on a web server during the configured history window. PHP fatal errors are not inherently malicious, but a newly observed fatal condition can indicate exploitation of a previously unseen application or PHP engine failure. The rule is intentionally generic so it can identify both known and novel exploit attempts that terminate PHP request processing.

Detection logic

agent.id:* and
event.dataset:(
  "apache.error" or "nginx.error" or "apache_tomcat.catalina" or "apache_tomcat.localhost"
) and (
  message:(PHP and Fatal and error)
)