Php Inline Command Execution

Title: Php Inline Command Execution
Status: test
Description:Detects execution of php using the "-r" flag. This is could be used as a way to launch a reverse shell or execute live php code.
References:
  -https://www.php.net/manual/en/features.commandline.php
  -https://www.revshells.com/
  -https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-02
modified:None
Tags:

• -'attack.execution'
• -'attack.t1059'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\php.exe' OriginalFileName:'php.exe'   selection_cli:
    CommandLine|contains: ' -r'
  condition:all of selection_*
Falsepositives:
  -Unknown
Level: medium