Query: write Sigma for Detects usage of the PHP CLI with the "-r" flag which allows it to run inline PHP code. The rule looks for calls to the
Matching passage: Sigma rule: Detects usage of the PHP CLI with the "-r" flag which allows it to run inline PHP code. The rule looks for calls to the. Logsource: linux / process_creation. Rule: title: Potential PHP Reverse Shell id: c6714a24-d7d5-4283-a36b-3ffd091d5f7e status: test description: 'Detects usage of the PHP CLI with the "-r" flag which allows it to run inline PHP code. The rule looks for calls to the "fsockopen" function which allows the creation of sockets. Attackers often leverage this in combination with functions such as "exec" or "fopen" to initiate a reverse shell connection. ' references: - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet - https://www.revshells.com/ author: '@d4ns4n_' date: 2023-04-07 tags: - attack.execution logsource: category: process_creation product: linux detection: selection: Image|contains: /php CommandLine|contains|all: - ' -r ' - fsockopen CommandLine|contains: - ash - bash - bsh - csh - ksh - pdksh - sh - tcsh - zsh condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects a highly relevant Antivirus alert that reports a web shell. It's highly recommended to tune this rule to the spe. Logsource: antivirus. Rule: title: Antivirus - Web Shell Detection Signature id: fdf135a2-9241-4f96-a114-bb404948f736 status: test description: 'Detects a highly relevant Antivirus alert that reports a web shell. It''s highly recommended to tune this rule to the specific strings used by your anti virus solution by downloading a big WebShell repository from e.g. github and checking the matches. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place. ' references: - https://www.nextron-systems.com/?s=antivirus - https://github.com/tennc/webshell - https://www.virustotal.com/gui/file/bd1d52289203866645e556e2766a21d2275877fbafa056a76fe0cf884b7f8819/detection - https://www.virustotal.com/gui/file/308487ed28a3d9abc1fec7ebc812d4b5c07ab025037535421f64c60d3887a3e8/detection - https://www.virustotal.com/gui/file/7d3cb8a8ff28f82b07f382789247329ad2d7782a72dde9867941f13266310c80/detection - https://www.virustotal.com/gui/file/e841675a4b82250c75273ebf0861245f80c6a1c3d5803c2d995d9d3b18d5c4b5/detection - https://www.virustotal.com/gui/file/a80042c61a0372eaa0c2c1e831adf0d13ef09feaf71d1d20b216156269045801/detection - https://www.virustotal.com/gui/file/b219f7d3c26f8bad7e175934cd5eda4ddb5e3983503e94ff07d39c0666821b7e/detection - https://www.virustotal.com/gui/file/b8702acf32fd651af9f809ed42d15135f842788cd98d81a8e1b154ee2a2b76a2/detection - https://www.virustotal.com/gui/file/13ae8bfbc02254b389ab052aba5e1ba169b16a399d9bc4cb7414c4a73cd7dc78/detection author: Florian Roth (Nextron Systems), Arnim Rupp date: 2018-09-09 modified: 2026-06-29 tags: - attack.persistence - attack.t1505.003 logsource: category: antivirus detection: selection: - Signature|startswith: - ASP. - IIS/BackDoor - JAVA/Backdoor - JSP. - Perl. - PHP. - Troj/ASP - Troj/JSP - Troj/PHP - VBS/Uxor - Signature|contains: - ASP_ - 'ASP:' - ASP.Agent - ASP/ - Aspdoor - ASPXSpy - Backdoor.ASP - Backdoor.Java - Backdoor.JSP - Backdoor.PHP - Backdoor.VBS - Backdoor/ASP - Backdoor/Java - Backdoor/JSP - Backdoor/PHP - Backdoor/VBS - C99shell - Chopper - filebrowser - JSP_ - 'JSP:' - JSP.Agent - JSP/ - 'Perl:' - Perl/ - PHP_ - 'PHP:' - PHP.Agent - PHP/ - PHPShell - PShlSpy - SinoChoper - Trojan.ASP - Trojan.JSP - Trojan.PHP - Trojan.VBS - VBS.Agent - VBS/Agent - Webshell condition: selection falsepositives: - Unlikely level: high