Linux Process Creation: PHP CLI Inline Code Using fsockopen with -r
Alerts on Linux executions of php -r inline code that references fsockopen, consistent with outbound reverse-shell style socket creation.
- Product
- linux
- Category
- process_creation
- Author
- @d4ns4n_ (SigmaHQ), DRL 1.1
- Published
- 2023-04-07
- Updated
- 2026-07-31
What it detects
This rule flags Linux process executions where the command line invokes the PHP CLI from a path containing “/php” with the “-r” option to run inline PHP code. It specifically matches inline code that includes the “fsockopen” function, indicating socket creation capability often used for remote command or reverse-shell style connectivity. It relies on process creation telemetry containing the image path and full command line, plus string matching for “-r” and “fsockopen”.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Linux Process Creation: PHP CLI Inline Code Using fsockopen with -r"
id: fe87cdbe-d8da-4144-9bc9-a15901066d45
status: test
description: This rule flags Linux process executions where the command line invokes the PHP CLI from a path containing “/php” with the “-r” option to run inline PHP code. It specifically matches inline code that includes the “fsockopen” function, indicating socket creation capability often used for remote command or reverse-shell style connectivity. It relies on process creation telemetry containing the image path and full command line, plus string matching for “-r” and “fsockopen”.
references:
- https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
- https://www.revshells.com/
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_php_reverse_shell.yml
author: "@d4ns4n_, Huntrule Team"
date: 2023-04-07
tags:
- attack.execution
logsource:
category: process_creation
product: linux
detection:
selection:
Image|contains: /php
CommandLine|contains|all:
- " -r "
- fsockopen
CommandLine|contains:
- ash
- bash
- bsh
- csh
- ksh
- pdksh
- sh
- tcsh
- zsh
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: c6714a24-d7d5-4283-a36b-3ffd091d5f7e
type: derived