Linux Auditd Inline PHP Code Execution

The following analytic detects PHP command-line interpreters executing code supplied directly on the command line with CLI code-execution options such as -r / --run and -B / -R / -E / -F, or PHP runtime INI overrides that can load code. It also detects code supplied to PHPDBG through the -s option and FrankenPHP php-cli execution. It covers common Linux CLI executable names, including php, versioned PHP binaries, phpdbg, and FrankenPHP. PHP-CGI and PHP-FPM are excluded from the CLI option branch because they do not support the PHP CLI inline -r option. This behavior can be used legitimately for administration and automation, but unexpected or obfuscated inline PHP execution may indicate an attacker using an installed interpreter to run commands without dropping a script file.