huntrule

Suspicious Windows Service Installed with PHP-CLI ImagePath in MagicINFO Path

PremiumReviewedSigma · High · v1
Product
windows
Service
system
Author
HuntRule
Published
2026-09-29
Updated
2026-09-29
AnalysisDetection

ATT&CK techniques

Persistence → Priv Esc

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects Windows service creation where the ImagePath points to php-cli.exe under the MagicINFO tomcat directory, a persistence mechanism Huntress observed after exploitation of the Samsung MagicINFO 9 server. Attackers register a masqueraded service, often via srvany, to run a PHP interpreter and maintain execution. A service whose binary is a scripting interpreter in an application directory is a strong persistence indicator.

Reporting behind it

Related detections9 linkedT1543.003 — drag to rearrange
Suspicious Service Creation Masquerading as Windows Defender
Suspicious Modification of Service ImagePath or ServiceDll
Suspicious Windows Service Creation via New-Service or nssm
Suspicious svchost.exe Loading Unsigned DLL (via image_load)
Suspicious K7Soft Autostart Persistence
Suspicious Service ImagePath Pointing to ShieldNetWork Driver via Registry
Suspicious Scarab Service Persistence Registration via Registry (via registry_set)
Suspicious Embargo Service irnagentd Creation via Process Creation
Suspicious HotPage Driver Drop under ShieldNetWork Directory via File System
Suspicious Windows Service Installed with PHP-CLI ImagePath in MagicINFO Path
Pivot detection · T1543.003 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.