ATT&CK T1082 - System Info Recon via HTTP (phpinfo)

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•4

This rule detects HTTP requests containing 'phpinfo' in the URI, which is commonly used for system information reconnaissance. This activity is associated with MITRE ATT&CK technique T1082 (System Information Discovery).