Potential PHP Reverse Shell

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•2•0•1

Detects usage of the PHP CLI with the "-r" flag which allows it to run inline PHP code. The rule looks for calls to the "fsockopen" function which allows the creation of sockets. Attackers often leverage this in combination with functions such as "exec" or "fopen" to initiate a reverse shell connection.