The Linux Auditd Inline PHP Code Execution rule detects inline PHP code execution on Linux endpoints by analyzing auditd execve events. It looks for PHP command-line invocations that pass code directly via CLI options such as -r / --run and -B / -R / -E / -F, or via PHP runtime ini overrides that load code (e.g., auto_prepend_file, auto_append_file, allow_url_include). It also detects code passed to PHPDBG with the -s option and FrankenPHP php-cli usage. The detection covers common CLI PHP binaries (php, versioned binaries), as well as phpdbg and frankenphp, and deliberately excludes PHP-CGI and PHP-FPM from the CLI-inline branch since they do not support the PHP CLI inline -r option. While these actions can be legitimate in administration or automation, unexpected or obfuscated inline PHP execution may indicate an attacker attempting to run commands without a script file. The rule ingests Linux auditd data (SYSCALL/EXECVE/PROCTITLE) via the Splunk Unix and Linux Add-on, normalizes fields to the CIM, and flags events where the command line contains inline PHP code or CLI overrides, with contextual details such as host, process, and user for investigation.