huntrule

Linux Process Creation: PHP CLI Inline Code Using fsockopen with -r

Alerts on Linux executions of php -r inline code that references fsockopen, consistent with outbound reverse-shell style socket creation.

FreeReviewedSigma · High · v2
Product
linux
Category
process_creation
Author
@d4ns4n_ (SigmaHQ), DRL 1.1
Published
2023-04-07
Updated
2026-07-31
AnalysisDetection
title: "Linux Process Creation: PHP CLI Inline Code Using fsockopen with -r"
id: fe87cdbe-d8da-4144-9bc9-a15901066d45
status: test
description: This rule flags Linux process executions where the command line invokes the PHP CLI from a path containing “/php” with the “-r” option to run inline PHP code. It specifically matches inline code that includes the “fsockopen” function, indicating socket creation capability often used for remote command or reverse-shell style connectivity. It relies on process creation telemetry containing the image path and full command line, plus string matching for “-r” and “fsockopen”.
references:
  - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
  - https://www.revshells.com/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_php_reverse_shell.yml
author: "@d4ns4n_, Huntrule Team"
date: 2023-04-07
tags:
  - attack.execution
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|contains: /php
    CommandLine|contains|all:
      - " -r "
      - fsockopen
    CommandLine|contains:
      - ash
      - bash
      - bsh
      - csh
      - ksh
      - pdksh
      - sh
      - tcsh
      - zsh
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: c6714a24-d7d5-4283-a36b-3ffd091d5f7e
    type: derived