YARA Detection Rule: EXT_WEBSHELL_PHP_Generic
Repository: Neo23x0/signature-base
Detects: php webshell having some kind of input and some kind of payload. restricted to small files or big ones including suspicious strings
Author: Arnim Rupp (https://github.com/ruppde)
Reference: Internal Research

Pattern signatures:
$wfp_tiny1 = "escapeshellarg" fullword
      $wfp_tiny2 = "addslashes" fullword

      //strings from private rule php_false_positive_tiny
      // try to use only strings which would be flagged by themselves as suspicious by other rules, e.g. eval
      //$gfp_tiny1 = "addslashes" fullword
      //$gfp_tiny2 = "escapeshellarg" fullword
      $gfp_tiny3 = "include \"./common.php\";"  // xcache
      $gfp_tiny4 = "assert('FALSE');"
      $gfp_tiny5 = "assert(false);"
      $gfp_tiny6 = "assert(FALSE);"
      $gfp_tiny7 = "assert('array_key_exists("
      $gfp_tiny8 = "echo shell_exec($aspellcommand . ' 2>&1');"
      $gfp_tiny9 = "throw new Exception('Could not find authentication source with id ' . $sourceId);"
      $gfp_tiny10 = "return isset( $_POST[ $key ] ) ? $_POST[ $key ] : ( isset( $_REQUEST[ $key ] ) ? $_REQUEST[ $key ] : $default );"
      $gfp_tiny11 = "; This is the recommended, PHP 4-style version of the php.ini-dist file"

      //strings from private rule capa_php_old_sa

Detection condition:
filesize < 500KB
      and (
         any of ($inp*)
      )
      and (
         any of ($cpayload*) or
         all of ($m_cpayload_preg_filter*)
      )
      and (
         (
            (
               $php_short in (0..100) or
               $php_short in (filesize - 1000..filesize)
         

Full rule:
rule EXT_WEBSHELL_PHP_Generic {
   meta:
      description = "php webshell having some kind of input and some kind of payload. restricted to small files or big ones including suspicious strings"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Arnim Rupp (https://github.com/ruppde)"
      reference = "Internal Research"
      score = 70
      date = "2021-01-14"
      modified = "2026-03-09"
      hash = "bee1b76b1455105d4bfe2f45191071cf05e83a309ae9defcf759248ca9bceddd"
      hash = "6bf351900a408120bee3fc6ea39905c6a35fe6efcf35d0a783ee92062e63a854"
      hash = "e3b4e5ec29628791f836e15500f6fdea19beaf3e8d9981c50714656c50d3b365"
      hash = "00813155bf7f5eb441e1619616a5f6b21ae31afc99caa000c4aafd54b46c3597"
      hash = "e31788042d9cdeffcb279533b5a7359b3beb1144f39bacdd3acdef6e9b4aff25"
      hash = "36b91575a08cf40d4782e5aebcec2894144f1e236a102edda2416bc75cbac8dd"
      hash = "a34154af7c0d7157285cfa498734cfb77662edadb1a10892eb7f7e2fb5e2486c"
      hash = "791a882af2cea0aa8b8379791b401bebc[PII_REDACTED]66ddb7f881c8923b7ea61"
      hash = "9a8ab3c225076a26309230d7eac7681f85b271d2db22bf5a190adbf66faca2e6"
      hash = "0d3ee83adc9ebf8fb1a8c449eed5547ee5e67e9a416cce25592e80963198ae23"
      hash = "3d[PII_REDACTED]a27634df[PII_REDACTED]d8ca784dbe89738e63951e12184ff07ad6"
      hash = "70d64d987f0d9ab46514abcc868505d95dbf458387f858b0d7580e4ee8573786"
      hash = "259b3828694b4d256764d7d01b0f0f36ca0526d5ee75e134c6a754d2ab0d1caa"
      hash = "04d139b48d59fa2ef24fb9347b74fa317cb05bd8b7389aeb0a4d458c49ea7540"
      hash = "58d0e2ff61301fe0c176b[PII_REDACTED]9d3278c7caf56310d202e0cdbdde9ac3f"
      hash = "731f36a08b0e63c63b3a2a457667dfc34aa7ff3a2aee24e60a8d16b83ad44ce2"
      hash = "e4ffd4ec67762fe00bb8bd9fbff78cffefdb96c16fe7551b5505d319a90fa18f"
      hash = "fa00ee25bfb3908808a7c6e8b2423c681d7c52de2deb30cbaea2ee09a635b7d4"
      hash = "98c1937b9606b1e8e0eebcb116a784c9d2d3db0039b21c45cba399e86c92c2fa"
      hash