| ID | Technique | Tactic |
|---|---|---|
| T1059 | Command and Scripting Interpreter | Execution |
Detection: Inline PHP Code Execution
Description
The following analytic detects PHP command-line interpreters executing code supplied directly on the command line with the CLI -r / --run options, per-line execution flags, non-empty auto-prepend or auto-append settings, or code supplied to PHPDBG through standard input. It covers common CLI executable names on Linux and Windows, including php.exe, php-win.exe, the legacy php-cli.exe name, versioned Linux php binaries, phpdbg, and FrankenPHP's php-cli subcommand. PHP-CGI and PHP-FPM are excluded because they do not support the PHP CLI inline -r option. This behavior can be used legitimately for administration and automation, but unexpected or obfuscated inline PHP execution may indicate an attacker using an installed interpreter to run commands without dropping a script file.
Search
1
2| tstats `security_content_summariesonly`
3 count min(_time) as firstTime
4 max(_time) as lastTime
5
6FROM datamodel=Endpoint.Processes WHERE
7(
8 (
9 Processes.process_name IN (
10 "php-cli.exe",
11 "php-cli",
12 "php-win.exe",
13 "php.exe",
14 "php",
15 "php5*",
16 "php7*",
17 "php8*",
18 "php9*"
19 )
20 NOT Processes.process_name IN ("*cgi*", "*fpm*")
21 Processes.process IN (
22 "* -r *", "* --run *", "* --run=*", "* -r\"*", "* -r'*", "* -r$*",
23 "* -B *", "* -R *", "* -E *", "* -F *",
24 "* --process-begin *", "* --process-code *", "* --process-file *", "* --process-end *",
25 "*auto_prepend_file=*", "*auto_append_file=*", "*allow_url_include=*"
26 )
27 )
28 OR
29 (
30 Processes.process_name IN ("phpdbg", "phpdbg.exe")
31 Processes.process IN ("* -s", "* -s ", "* -s=*")
32 )
33 OR
34 (
35 Processes.process_name IN ("frankenphp", "frankenphp.exe")
36 Processes.process="*php-cli*"
37 Processes.process IN ("* -r *", "* -r\"*", "* -r'*", "* -r$*")
38 )
39)
40
41BY Processes.action Processes.dest Processes.original_file_name
42 Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
43 Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
44 Processes.process Processes.process_exec Processes.process_guid
45 Processes.process_hash Processes.process_id Processes.process_integrity_level
46 Processes.process_name Processes.process_path Processes.user
47 Processes.user_id Processes.vendor_product
48
49
50| `drop_dm_object_name(Processes)`
51
52
53| eval php_inline_r=if(match(process, "(^
54|\s)(-r
55|--run)(\s
56|=
57|\"
58|'
59|\$)"), 1, 0)
60
61| eval php_per_line=if(match(process, "(^
62|\s)(-[BREF]
63|--process-(begin
64|code
65|file
66|end))(\s
67|$)"), 1, 0)
68
69| eval php_ini_inject=if(match(process, "(?i)-d\s*\"?(auto_prepend_file
70|auto_append_file)\s*=\s*\"?[^\s\"']"), 1, 0)
71
72| eval php_allow_url_include=if(match(process, "(?i)-d\s*\"?allow_url_include\s*=\s*\"?(?:1
73|on
74|true
75|yes)(?=\s
76|\"
77|'
78|$)"), 1, 0)
79
80| eval phpdbg_or_franken=if(match(process_name, "(?i)^(phpdbg
81|frankenphp)"), 1, 0)
82
83
84| where (
85 php_inline_r=1
86 OR php_per_line=1
87 OR php_ini_inject=1
88 OR php_allow_url_include=1
89 OR phpdbg_or_franken=1
90)
91
92
93| where NOT (
94 lower(parent_process_name)="cmd.exe"
95 AND like(lower(process), "%\\.config\\herd\\bin\\php8%\\php.exe%")
96 AND like(lower(process), "% -r \"define('laravel_start'%")
97 AND like(lower(process), "%vendor/autoload.php%")
98 AND like(lower(process), "%bootstrap/app.php%")
99)
100
101
102| `security_content_ctime(firstTime)`
103
104| `security_content_ctime(lastTime)`
105
106| `inline_php_code_execution_filter`
Data Source
| Name | Platform | Sourcetype | Source |
|---|---|---|---|
| CrowdStrike ProcessRollup2 | Other | 'crowdstrike:events:sensor' |
'crowdstrike' |
| Sysmon for Linux EventID 1 |  Linux |
'sysmon:linux' |
'Syslog:Linux-Sysmon/Operational' |
| Windows Event Log Security 4688 |  Windows |
'XmlWinEventLog' |
'XmlWinEventLog:Security' |
| Sysmon EventID 1 | Windows |
'XmlWinEventLog' |
'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational' |
Macros Used
| Name | Value |
|---|---|
| security_content_summariesonly | summariesonly=summariesonly_config allow_old_summaries=oldsummaries_config fillnull_value=fillnull_config`` |
| inline_php_code_execution_filter | search * |
inline_php_code_execution_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Annotations
MITRE ATT&CK
Kill Chain Phases
NIST
CIS
Threat Actors
Installation
DE.AE
CIS 10
Default Configuration
This detection is configured by default in Splunk Enterprise Security to run with the following settings:
| Setting | Value |
|---|---|
| Disabled | true |
| Cron Schedule | 0 * * * * |
| Earliest Time | -70m@m |
| Latest Time | -10m@m |
| Schedule Window | auto |
| Creates Finding (Notable) | No |
| Creates Intermediate Finding (Risk Event) | Yes |
Anomaly detections generate Intermediate Findings (Risk Events). They do not generate a Finding (Notable) directly.
Implementation
The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the Processes node of the Endpoint data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
Known False Positives
Developers and administrators may use PHP CLI or PHPDBG for legitimate automation and troubleshooting. Review the command line, parent process, user, host, and execution context. Tune approved automation by host or parent process as needed.
Associated Analytic Story
Intermediate Findings
| Message | Entity Field | Entity Type | Risk Score |
|---|---|---|---|
| PHP inline code execution using [$process_name$] was observed on endpoint [$dest$] by user [$user$] with command line [$process$]. | dest | system | 20 |
Threat Objects
| Field | Type |
|---|---|
| process_name | process_name |
| process | process |
References
Detection Testing
| Test Type | Status | Dataset | Source | Sourcetype |
|---|---|---|---|---|
| Validation | ✅ Passing | N/A | N/A | N/A |
| Unit | ✅ Passing | Dataset | XmlWinEventLog:Microsoft-Windows-Sysmon/Operational |
XmlWinEventLog |
| Integration | ✅ Passing | Dataset | XmlWinEventLog:Microsoft-Windows-Sysmon/Operational |
XmlWinEventLog |
Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI.
Alternatively you can replay a dataset into a Splunk Attack Range
Source: GitHub |
Version: 2