Linux Process Creation: PHP Inline Code Using -r and fsockopen for Reverse Shell Setup

title: "Linux Process Creation: PHP Inline Code Using -r and fsockopen for Reverse Shell Setup"
id: fe87cdbe-d8da-4144-9bc9-a15901066d45
status: test
description: This rule flags Linux process executions where the command line indicates PHP is invoked with the -r flag to run inline PHP code and the inline code includes the fsockopen function. fsockopen can be used to create outbound socket connections, which attackers commonly combine with shell invocation patterns to establish reverse shells. The detection relies on process creation telemetry containing the process image path and command-line arguments.
references:
  - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
  - https://www.revshells.com/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_php_reverse_shell.yml
author: "@d4ns4n_, Huntrule Team"
date: 2023-04-07
tags:
  - attack.execution
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|contains: /php
    CommandLine|contains|all:
      - " -r "
      - fsockopen
    CommandLine|contains:
      - ash
      - bash
      - bsh
      - csh
      - ksh
      - pdksh
      - sh
      - tcsh
      - zsh
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: c6714a24-d7d5-4283-a36b-3ffd091d5f7e
    type: derived