Inline PHP Code Execution

The following analytic detects PHP command-line interpreters executing code supplied directly on the command line with the CLI -r / --run options, or code supplied to PHPDBG through standard input. It covers common CLI executable names on Linux and Windows, including php.exe, php-win.exe, the legacy php-cli.exe name, versioned Linux php binaries, phpdbg, and FrankenPHP's php-cli subcommand. PHP-CGI and PHP-FPM are excluded because they do not support the PHP CLI inline -r option. This behavior can be used legitimately for administration and automation, but unexpected or obfuscated inline PHP execution may indicate an attacker using an installed interpreter to run commands without dropping a script file.