Detections identify when a PHP command-line interpreter executes code provided directly on the command line (via -r, --run, or inline input to PHPDBG) rather than running a pre-written script. The rule covers common PHP CLI binaries across Windows and Linux (php.exe, php-win.exe, php-cli.exe, php, php5*, php7*, php8*, php9*), the PHPDBG tool, and FrankenPHP’s php-cli subcommand. PHP-CGI and PHP-FPM are excluded since they do not support the inline -r option. The technique is indicative of potential abuse where an attacker uses an installed PHP interpreter to run arbitrary commands without dropping a script. The detection uses endpoint telemetry from EDR sources (process and command-line data) and groups findings by process and parent-process relationships, user, host, and file/process metadata. It relies on complete command-line logging and CIM-normalized fields to correlate process_name, process, and related attributes. The rule aligns with MITRE ATT&CK T1059 (Command and Scripting Interpreter) and includes an intermediate finding to surface contextual details such as the destination host and user, with an emphasis on inline command execution rather than script files. The alert acknowledges legitimate administration and automation use and recommends review and tuning by host or parent process to reduce false positives. Overall, it detects a narrow, high-risk path for inline code execution via PHP on endpoints.