title: PHP File Written in a Web Root by the Web Server User
id: 10b6e900-27cc-49b0-acba-d746e9265cf6
status: experimental
description: |
    Detects a .php, .phtml or .phar file created under a common web root by the web server or PHP-FPM user (www-data, nginx, apache, nobody).
    A web shell or a second-stage dropper written through a web flaw looks like this. Needs file creation events with the user (auditd file watch, Sysmon for Linux event 11).
    Exclude your deploy user, package manager and framework cache directories. Lab run 2026-10-24: matched 2 of 5 file events (.php by user id 33 from apache2 and php-fpm); a cache file, a .txt file and a root-written .php did not match; lab's own evaluator, not a SIEM.
references:
    - https://cyray.io/attack-to-detection/t1190-php2shell-php-multipart-rce
author: CyRay
date: 2026-10-21
tags:
    - attack.initial-access
    - attack.t1190
    - attack.persistence
    - attack.t1505.003
logsource:
    category: file_event
    product: linux
detection:
    selection:
        User:
            - 'www-data'
            - 'nginx'
            - 'apache'
            - 'nobody'
        TargetFilename|contains:
            - '/var/www/'
            - '/usr/share/nginx/'
            - '/srv/www/'
            - '/srv/http/'
        TargetFilename|endswith:
            - '.php'
            - '.phtml'
            - '.phar'
    filter_cache:
        TargetFilename|contains:
            - '/cache/'
            - '/storage/framework/'
            - '/var/cache/'
    condition: selection and not 1 of filter_*
falsepositives:
    - CMS plugin or theme installs and updates run as the web user
    - Frameworks that compile templates to .php outside the excluded cache paths
level: medium