Windows: Inline PHP execution via php.exe -r flag

title: "Windows: Inline PHP execution via php.exe -r flag"
id: 3c7738cc-8976-4bde-873c-b5436e902ab0
status: test
description: This rule identifies process creation events where php.exe is executed with the inline code flag "-r". Attackers may use this to run PHP code immediately without writing a separate script file, which can support rapid command execution and follow-on actions. The detection relies on Windows process creation telemetry, matching the php.exe image (including filename indicators) and the presence of " -r" in the command line.
references:
  - https://www.php.net/manual/en/features.commandline.php
  - https://www.revshells.com/
  - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_php_inline_command_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-02
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \php.exe
    - OriginalFileName: php.exe
  selection_cli:
    CommandLine|contains: " -r"
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: d81871ef-5738-47ab-9797-7a9c90cd4bfb
    type: derived