title: Web Server or PHP-FPM Spawning a Shell or Download/Network Tool on Linux
id: b12b1b66-2735-4cd7-8a56-518e03397c46
status: experimental
description: |
    Detects a web server or PHP process (php-fpm, php-cgi, nginx, apache2, httpd) starting a shell, curl, wget or a netcat variant on Linux.
    This is what a successful remote code execution against a PHP host usually does next, whatever the first-stage exploit was.
    Needs process creation with the parent process (auditd execve with parent, or Sysmon for Linux event 1). Lab run 2026-10-24: matched 2 of 144 exec events with the parent read from audit data (`sh -c id` from apache2 and php-fpm); two `sh -c curl` parents unproven; lab's own evaluator, not a SIEM.
references:
    - https://cyray.io/attack-to-detection/t1190-php2shell-php-multipart-rce
author: CyRay
date: 2026-10-21
tags:
    - attack.initial-access
    - attack.t1190
    - attack.execution
    - attack.t1059.004
    - attack.persistence
    - attack.t1505.003
logsource:
    category: process_creation
    product: linux
detection:
    selection_parent:
        ParentImage|contains:
            - 'php-fpm'
            - 'php-cgi'
            - '/nginx'
            - '/apache2'
            - '/httpd'
    selection_child:
        Image|endswith:
            - '/sh'
            - '/bash'
            - '/dash'
            - '/curl'
            - '/wget'
            - '/nc'
            - '/ncat'
            - '/netcat'
    condition: all of selection_*
falsepositives:
    - CMS image tools and backup plugins that call a shell (filter by command line once a baseline exists)
    - Mail sending through sh from php-fpm
level: high