Elastic Security Detection Rules

First Occurrence of a PHP Fatal Error on a Web Server

Last updated 2 days ago on 2026-10-22
Created 2 days ago on 2026-10-22

About

This rule identifies the first PHP fatal error observed on a web server during the configured history window. PHP fatal errors are not inherently malicious, but a newly observed fatal condition can indicate exploitation of a previously unseen application or PHP engine failure. The rule is intentionally generic so it can identify both known and novel exploit attempts that terminate PHP request processing.
Tags
Domain: WebUse Case: Threat DetectionTactic: Initial AccessData Source: NginxData Source: ApacheData Source: Apache TomcatRule Type: New TermsService: NginxService: Apache TomcatService: Apache HTTP ServerLanguage: kuery
Severity
medium
Risk Score
47
MITRE ATT&CK™

Initial Access (TA0001)(external, opens in a new tab or window)

↳ Exploit Public-Facing Application (T1190)(external, opens in a new tab or window)

False Positive Examples
New deployments, application defects, dependency changes, resource exhaustion, and configuration errors can legitimately produce a first-seen PHP fatal error. Development, staging, and quality-assurance systems may generate frequent novel fatal errors during testing.
License
Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type
New Terms Rule
Integration Pack
Prebuilt Security Detection Rules
Index Patterns
logs-apache.error-*logs-apache_tomcat.catalina-*logs-apache_tomcat.localhost-*logs-nginx.error-*
Related Integrations

nginx(external, opens in a new tab or window)

apache(external, opens in a new tab or window)

apache_tomcat(external, opens in a new tab or window)

Query
text code block:
agent.id:* and
event.dataset:(
  "apache.error" or "nginx.error" or "apache_tomcat.catalina" or "apache_tomcat.localhost"
) and (
  message:(PHP and Fatal and error)
)

Install detection rules in Elastic Security

Detect First Occurrence of a PHP Fatal Error on a Web Server in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).