deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: DkShell_4000bd83451f0d8501a9dfad60dce39e55ae167d
Repository: Neo23x0/signature-base
Detects: Detects a web shell
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/bartblaze/PHP-backdoors

Pattern signatures:
$x1 = "DK Shell - Took the Best made it Better..!!" fullword ascii
		$x2 = "preg_replace(\"/.*/e\",\"\\x65\\x76\\x61\\x6C\\x28\\x67\\x7A\\x69\\x6E\\x66\\x6C\\x61\\x74\\x65\\x28\\x62\\x61\\x73\\x65\\x36\\x" ascii
		$x3 = "echo '<b>Sw Bilgi<br><br>'.php_uname().'<br></b>';" fullword ascii

		$s1 = "echo '<form action=\"\" method=\"post\" enctype=\"multipart/form-data\" name=\"uploader\" id=\"uploader\">';" fullword ascii
		$s9 = "$x = $_GET[\"x\"];" fullword ascii

Detection condition:
( uint16(0) == 0x3f3c and filesize < 200KB and 1 of ($x*) ) or ( 3 of them )

Full rule:
rule DkShell_4000bd83451f0d8501a9dfad60dce39e55ae167d {
	meta:
		description = "Detects a web shell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/bartblaze/PHP-backdoors"
		date = "2016-09-10"
		hash1 = "51a16b09520a3e063adf10ff[PII_REDACTED]a5de1add8341a43da5326e626315bd"
		id = "804f7229-1440-5a2e-91cd-a58a38b22aa9"
	strings:
		$x1 = "DK Shell - Took the Best made it Better..!!" fullword ascii
		$x2 = "preg_replace(\"/.*/e\",\"\\x65\\x76\\x61\\x6C\\x28\\x67\\x7A\\x69\\x6E\\x66\\x6C\\x61\\x74\\x65\\x28\\x62\\x61\\x73\\x65\\x36\\x" ascii
		$x3 = "echo '<b>Sw Bilgi<br><br>'.php_uname().'<br></b>';" fullword ascii

		$s1 = "echo '<form action=\"\" method=\"post\" enctype=\"multipart/form-data\" name=\"uploader\" id=\"uploader\">';" fullword ascii
		$s9 = "$x = $_GET[\"x\"];" fullword ascii
	condition:
		( uint16(0) == 0x3f3c and filesize < 200KB and 1 of ($x*) ) or ( 3 of them )
}
YARA Detection Rule: WebShell_5786d7d9f4b0df731d79ed927fb5a124195fc901
Repository: Neo23x0/signature-base
Detects: Detects a web shell
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/bartblaze/PHP-backdoors

Pattern signatures:
$s1 = "preg_replace(\"\\x2F\\x2E\\x2A\\x2F\\x65\",\"\\x65\\x76\\x61\\x6C\\x28\\x67\\x7A\\x69\\x6E\\x66\\x6C\\x61\\x74\\x65\\x28\\x62\\x" ascii
		$s2 = "input[type=text], input[type=password]{" fullword ascii

Detection condition:
( uint16(0) == 0x6c3c and filesize < 80KB and all of them )

Full rule:
rule WebShell_5786d7d9f4b0df731d79ed927fb5a124195fc901 {
	meta:
		description = "Detects a web shell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/bartblaze/PHP-backdoors"
		date = "2016-09-10"
		hash1 = "b1733cbb0eb3d440c4174cc67ca693ba92308ded5fc1069ed650c3c78b1da4bc"
		id = "7958e5fc-5ac5-58bc-8128-0a778e99a4e4"
	strings:
		$s1 = "preg_replace(\"\\x2F\\x2E\\x2A\\x2F\\x65\",\"\\x65\\x76\\x61\\x6C\\x28\\x67\\x7A\\x69\\x6E\\x66\\x6C\\x61\\x74\\x65\\x28\\x62\\x" ascii
		$s2 = "input[type=text], input[type=password]{" fullword ascii
	condition:
		( uint16(0) == 0x6c3c and filesize < 80KB and all of them )
}
YARA Detection Rule: webshell_e8eaf8da94012e866e51547cd63bb996379690bf
Repository: Neo23x0/signature-base
Detects: Detects a web shell
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/bartblaze/PHP-backdoors

Pattern signatures:
$x1 = "@exec('./bypass/ln -s /etc/passwd 1.php');" fullword ascii
		$x2 = "echo \"<iframe src=mysqldumper/index.php width=100% height=100% frameborder=0></iframe> \";" fullword ascii
		$x3 = "@exec('tar -xvf mysqldumper.tar.gz');" fullword ascii

Detection condition:
( uint16(0) == 0x213c and filesize < 100KB and 1 of ($x*) ) or ( 2 of them )

Full rule:
rule webshell_e8eaf8da94012e866e51547cd63bb996379690bf {
	meta:
		description = "Detects a web shell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/bartblaze/PHP-backdoors"
		date = "2016-09-10"
		hash1 = "027544baa[PII_REDACTED]e97dc908bd43f0fb940510119fc4cce0883f3dd88275"
		id = "8fda9b9f-9a72-5123-91d7-0d0aec9e17bc"
	strings:
		$x1 = "@exec('./bypass/ln -s /etc/passwd 1.php');" fullword ascii
		$x2 = "echo \"<iframe src=mysqldumper/index.php width=100% height=100% frameborder=0></iframe> \";" fullword ascii
		$x3 = "@exec('tar -xvf mysqldumper.tar.gz');" fullword ascii
	condition:
		( uint16(0) == 0x213c and filesize < 100KB and 1 of ($x*) ) or ( 2 of them )
}
YARA Detection Rule: Unknown_0f06c5d1b32f4994c3b3abf8bb76d5468f105167
Repository: Neo23x0/signature-base
Detects: Detects a web shell
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/bartblaze/PHP-backdoors

Pattern signatures:
$s1 = "$check = $_SERVER['DOCUMENT_ROOT'] . \"/libraries/lola.php\" ;" fullword ascii
		$s2 = "$fp=fopen(\"$check\",\"w+\");" fullword ascii
		$s3 = "fwrite($fp,base64_decode('" ascii

Detection condition:
( uint16(0) == 0x6324 and filesize < 2KB and all of them )

Full rule:
rule Unknown_0f06c5d1b32f4994c3b3abf8bb76d5468f105167 {
	meta:
		description = "Detects a web shell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/bartblaze/PHP-backdoors"
		date = "2016-09-10"
		hash1 = "[PII_REDACTED]ac7455fa9461ed0483032a1886543f213a431f81a2ac76d383b47e"
		id = "efd09da2-f232-5a21-99c8-dc2bf00baa73"
	strings:
		$s1 = "$check = $_SERVER['DOCUMENT_ROOT'] . \"/libraries/lola.php\" ;" fullword ascii
		$s2 = "$fp=fopen(\"$check\",\"w+\");" fullword ascii
		$s3 = "fwrite($fp,base64_decode('" ascii
	condition:
		( uint16(0) == 0x6324 and filesize < 2KB and all of them )
}
YARA Detection Rule: WSOShell_0bbebaf46f87718caba581163d4beed56ddf73a7
Repository: Neo23x0/signature-base
Detects: Detects a web shell
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/bartblaze/PHP-backdoors

Pattern signatures:
$s8 = "$default_charset='Wi'.'ndo.'.'ws-12'.'51';" fullword ascii
		$s9 = "$mosimage_session = \"" fullword ascii

Detection condition:
( uint16(0) == 0x3f3c and filesize < 300KB and all of them )

Full rule:
rule WSOShell_0bbebaf46f87718caba581163d4beed56ddf73a7 {
	meta:
		description = "Detects a web shell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/bartblaze/PHP-backdoors"
		date = "2016-09-10"
		hash1 = "d053086907aed21fbb6019bf9e644d2bae61c63563c4c3b948d755db3e78f395"
		id = "92[PII_REDACTED]-588d-ba2a-5ef6b7499a5a"
	strings:
		$s8 = "$default_charset='Wi'.'ndo.'.'ws-12'.'51';" fullword ascii
		$s9 = "$mosimage_session = \"" fullword ascii
	condition:
		( uint16(0) == 0x3f3c and filesize < 300KB and all of them )
}
YARA Detection Rule: WebShell_Generic_1609_A
Repository: Neo23x0/signature-base
Detects: Auto-generated rule
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/bartblaze/PHP-backdoors

Pattern signatures:
$s1 = "return $qwery45234dws($b);" fullword ascii

Detection condition:
( uint16(0) == 0x3f3c and 1 of them )

Full rule:
rule WebShell_Generic_1609_A {
	meta:
		description = "Auto-generated rule"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/bartblaze/PHP-backdoors"
		date = "2016-09-10"
		super_rule = 1
		hash1 = "c817a490cfd4d6377c15c9ac9bcfa136f4a45ff5b40c74f15216c030f657d035"
		hash3 = "69b9d55ea2eb4a0d9cfe3b21b0c112c31ea197d1cb00493d1dddc78b90c5745e"
		id = "4b7db4db-8699-5b4d-ab90-ce79f1160984"
	strings:
		$s1 = "return $qwery45234dws($b);" fullword ascii
	condition:
		( uint16(0) == 0x3f3c and 1 of them )
}
YARA Detection Rule: Nishang_Webshell
Repository: Neo23x0/signature-base
Detects: Detects a ASPX web shell
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/samratashok/nishang

Pattern signatures:
$s1 = "psi.Arguments = \"-noninteractive \" + \"-executionpolicy bypass \" + arg;" ascii
		$s2 = "output.Text += \"\nPS> \" + console.Text + \"\n\" + do_ps(console.Text);" ascii
		$s3 = "<title>Antak Webshell</title>" fullword ascii
		$s4 = "<asp:Button ID=\"executesql\" runat=\"server\" Text=\"Execute SQL Query\"" ascii

Detection condition:
( uint16(0) == 0x253C and filesize < 100KB and 1 of ($s*) )

Full rule:
rule Nishang_Webshell {
	meta:
		description = "Detects a ASPX web shell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/samratashok/nishang"
		date = "2016-09-11"
		id = "785e6da7-097e-598b-9799-ffe43738d718"
	strings:
		$s1 = "psi.Arguments = \"-noninteractive \" + \"-executionpolicy bypass \" + arg;" ascii
		$s2 = "output.Text += \"\nPS> \" + console.Text + \"\n\" + do_ps(console.Text);" ascii
		$s3 = "<title>Antak Webshell</title>" fullword ascii
		$s4 = "<asp:Button ID=\"executesql\" runat=\"server\" Text=\"Execute SQL Query\"" ascii
	condition:
		( uint16(0) == 0x253C and filesize < 100KB and 1 of ($s*) )
}
YARA Detection Rule: PHP_Webshell_1_Feb17
Repository: Neo23x0/signature-base
Detects: Detects a simple cloaked PHP web shell
Author: Florian Roth (Nextron Systems)
Reference: https://isc.sans.edu/diary/Analysis+of+a+Simple+PHP+Backdoor/22127

Pattern signatures:
$h1 = "<?php ${\"\\x" ascii

      $x1 = "\";global$auth;function sh_decrypt_phase($data,$key){${\"" ascii
      $x2 = "global$auth;return sh_decrypt_phase(sh_decrypt_phase($" ascii
      $x3 = "]}[\"\x64\"]);}}echo " ascii
      $x4 = "\"=>@phpversion(),\"\\x" ascii

      /* Decloaked version */
      $s1 = "$i=Array(\"pv\"=>@phpversion(),\"sv\"" ascii
      $s3 = "$data = @unserialize(sh_decrypt(@base64_decode($data),$data_key));" ascii

Detection condition:
uint32(0) == 0x68703f3c and ( $h1 at 0 and 1 of them ) or 2 of them

Full rule:
rule PHP_Webshell_1_Feb17 {
   meta:
      description = "Detects a simple cloaked PHP web shell"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://isc.sans.edu/diary/Analysis+of+a+Simple+PHP+Backdoor/22127"
      date = "2017-02-28"
      id = "eedf87c9-2dab-530d-b5d8-a4c2ebc87821"
   strings:
      $h1 = "<?php ${\"\\x" ascii

      $x1 = "\";global$auth;function sh_decrypt_phase($data,$key){${\"" ascii
      $x2 = "global$auth;return sh_decrypt_phase(sh_decrypt_phase($" ascii
      $x3 = "]}[\"\x64\"]);}}echo " ascii
      $x4 = "\"=>@phpversion(),\"\\x" ascii

      /* Decloaked version */
      $s1 = "$i=Array(\"pv\"=>@phpversion(),\"sv\"" ascii
      $s3 = "$data = @unserialize(sh_decrypt(@base64_decode($data),$data_key));" ascii
   condition:
      uint32(0) == 0x68703f3c and ( $h1 at 0 and 1 of them ) or 2 of them
}
YARA Detection Rule: Webshell_Tiny_JSP_2
Repository: Neo23x0/signature-base
Detects: Detects a tiny webshell - chine chopper
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s1 = "<%eval(Request(" nocase

Detection condition:
uint16(0) == 0x253c and filesize < 40 and all of them

Full rule:
rule Webshell_Tiny_JSP_2 {
	meta:
		description = "Detects a tiny webshell - chine chopper"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2015-12-05"
		score = 100
		id = "b628c4f9-eb07-592d-834a-5c94e41987da"
	strings:
		$s1 = "<%eval(Request(" nocase
	condition:
		uint16(0) == 0x253c and filesize < 40 and all of them
}
YARA Detection Rule: Wordpress_Config_Webshell_Preprend
Repository: Neo23x0/signature-base
Detects: Webshell that uses standard Wordpress wp-config.php file and appends the malicious code in front of it
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$x1 = " * @package WordPress" fullword ascii

      $s1 = "define('DB_NAME'," ascii
      $s2 = "require_once(ABSPATH . 'wp-settings.php');" ascii

      $fp1 = "iThemes Security Config" ascii

Detection condition:
uint32(0) == 0x68703f3c and filesize < 400KB and
      $x1 and
      all of ($s*) and
      not $x1 in (0..1000) and
      not 1 of ($fp*)

Full rule:
rule Wordpress_Config_Webshell_Preprend {
   meta:
      description = "Webshell that uses standard Wordpress wp-config.php file and appends the malicious code in front of it"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2017-06-25"
		score = 65
      id = "2a432c53-5dee-5a2e-9ccf-9e5d52713af9"
   strings:
      $x1 = " * @package WordPress" fullword ascii

      $s1 = "define('DB_NAME'," ascii
      $s2 = "require_once(ABSPATH . 'wp-settings.php');" ascii

      $fp1 = "iThemes Security Config" ascii
   condition:
      uint32(0) == 0x68703f3c and filesize < 400KB and
      $x1 and
      all of ($s*) and
      not $x1 in (0..1000) and
      not 1 of ($fp*)
}
YARA Detection Rule: PAS_Webshell_Encoded
Repository: Neo23x0/signature-base
Detects: Detects a PAS webshell
Author: Florian Roth (Nextron Systems)
Reference: http://blog.talosintelligence.com/2017/07/the-medoc-connection.html

Pattern signatures:
$head1 = "<?php $____=" fullword ascii
      $head2 = "'base'.(32*2).'"

      $enc1 = "isset($_COOKIE['___']" ascii
      $enc2 = "if($___!==NULL){" ascii
      $enc3 = ").substr(md5(strrev($" ascii
      $enc4 = "]))%256);$" ascii
      $enc5 = "]))@setcookie('" ascii
      $enc6 = "]=chr(( ord($_" ascii

      /* =\x0A'));if(isset($_COOKIE[' */
      $x1 = { 3D 0A 27 29 29 3B 69 66 28 69 73 73 65 74 28 24 5F 43 4F 4F 4B 49 45 5B 27 }

      $foot1 = "value=\"\"/><input type=\"submit\" value=\"&gt;\"/></form>"
      $foot2 = "();}} @header(\"Status: 404 Not Found\"); ?>"

Detection condition:
( uint32(0) == 0x68703f3c and filesize < 80KB and (
         3 of them or
         $head1 at 0 or
         $head2 in (0..20) or
         1 of ($x*)
         )
      ) or
      $foot1 at (filesize-52) or
      $foot2 at (filesize-44)

Full rule:
rule PAS_Webshell_Encoded {
   meta:
      description = "Detects a PAS webshell"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "http://blog.talosintelligence.com/2017/07/the-medoc-connection.html"
      date = "2017-07-11"
      score = 80
      id = "6cb547ad-7a97-5c3d-83e1-114ea798ddb8"
   strings:
      $head1 = "<?php $____=" fullword ascii
      $head2 = "'base'.(32*2).'"

      $enc1 = "isset($_COOKIE['___']" ascii
      $enc2 = "if($___!==NULL){" ascii
      $enc3 = ").substr(md5(strrev($" ascii
      $enc4 = "]))%256);$" ascii
      $enc5 = "]))@setcookie('" ascii
      $enc6 = "]=chr(( ord($_" ascii

      /* =\x0A'));if(isset($_COOKIE[' */
      $x1 = { 3D 0A 27 29 29 3B 69 66 28 69 73 73 65 74 28 24 5F 43 4F 4F 4B 49 45 5B 27 }

      $foot1 = "value=\"\"/><input type=\"submit\" value=\"&gt;\"/></form>"
      $foot2 = "();}} @header(\"Status: 404 Not Found\"); ?>"
   condition:
      ( uint32(0) == 0x68703f3c and filesize < 80KB and (
         3 of them or
         $head1 at 0 or
         $head2 in (0..20) or
         1 of ($x*)
         )
      ) or
      $foot1 at (filesize-52) or
      $foot2 at (filesize-44)
}
YARA Detection Rule: ALFA_SHELL
Repository: Neo23x0/signature-base
Detects: Detects web shell often used by Iranian APT groups
Author: Florian Roth (Nextron Systems)
Reference: Internal Research - APT33

Pattern signatures:
$x1 = "$OOO000000=urldecode('%66%67%36%73%62%65%68%70%72%61%34%63%6f%5f%74%6e%64')" ascii
      $x2 = "#solevisible@gmail.com" fullword ascii
      $x3 = "'login_page' => '500',//gui or 500 or 403 or 404" fullword ascii
      $x4 = "$GLOBALS['__ALFA__']" fullword ascii
      $x5 = "if(!function_exists('b'.'as'.'e6'.'4_'.'en'.'co'.'de')" ascii
      $f1 = { 76 2F 38 76 2F 36 76 2F 2B 76 2F 2F 66 38 46 27 29 3B 3F 3E 0D 0A }

Detection condition:
( filesize < 900KB and 2 of ($x*) or $f1 at (filesize-22) )

Full rule:
rule ALFA_SHELL {
   meta:
      description = "Detects web shell often used by Iranian APT groups"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research - APT33"
      date = "2017-09-21"
      hash1 = "a39d8823d54c55e60a7395772e50d116408804c1a5368391a1e5871dbdc83547"
      id = "f0be44ec-bff0-5d01-aabd-df7aa05383e3"
   strings:
      $x1 = "$OOO000000=urldecode('%66%67%36%73%62%65%68%70%72%61%34%63%6f%5f%74%6e%64')" ascii
      $x2 = "#solevisible@gmail.com" fullword ascii
      $x3 = "'login_page' => '500',//gui or 500 or 403 or 404" fullword ascii
      $x4 = "$GLOBALS['__ALFA__']" fullword ascii
      $x5 = "if(!function_exists('b'.'as'.'e6'.'4_'.'en'.'co'.'de')" ascii
      $f1 = { 76 2F 38 76 2F 36 76 2F 2B 76 2F 2F 66 38 46 27 29 3B 3F 3E 0D 0A }
   condition:
      ( filesize < 900KB and 2 of ($x*) or $f1 at (filesize-22) )
}
YARA Detection Rule: Webshell_FOPO_Obfuscation_APT_ON_Nov17_1
Repository: Neo23x0/signature-base
Detects: Detects malware from NK APT incident DE
Author: Florian Roth (Nextron Systems)
Reference: Internal Research - ON

Pattern signatures:
$x1 = "Obfuscation provided by FOPO" fullword ascii

      $s1 = "\";@eval($" ascii
      $f1 = { 22 29 29 3B 0D 0A 3F 3E }

Detection condition:
uint16(0) == 0x3f3c and filesize < 800KB and (
        $x1 or
        ( $s1 in (0..350) and $f1 at (filesize-23) )
      )

Full rule:
rule Webshell_FOPO_Obfuscation_APT_ON_Nov17_1 {
   meta:
      description = "Detects malware from NK APT incident DE"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research - ON"
      date = "2017-11-17"
      hash1 = "ed6e2e0027d3f564f5ce438984dc8a54577df822ce56ce079c60c99a91d5ffb1"
      id = "0122bb03-8ff0-554d-8fee-458f0ddd7664"
   strings:
      $x1 = "Obfuscation provided by FOPO" fullword ascii

      $s1 = "\";@eval($" ascii
      $f1 = { 22 29 29 3B 0D 0A 3F 3E }
   condition:
      uint16(0) == 0x3f3c and filesize < 800KB and (
        $x1 or
        ( $s1 in (0..350) and $f1 at (filesize-23) )
      )
}
YARA Detection Rule: WebShell_JexBoss_JSP_1
Repository: Neo23x0/signature-base
Detects: Detects JexBoss JSPs
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$x1 = "equals(\"jexboss\")"
      $x2 = "%><pre><%if(request.getParameter(\"ppp\") != null &&" ascii

      $s1 = "<%@ page import=\"java.util.*,java.io.*\"%><pre><% if (request.getParameter(\""
      $s2 = "!= null && request.getHeader(\"user-agent\"" ascii
      $s3 = "String disr = dis.readLine(); while ( disr != null ) { out.println(disr); disr = dis.readLine(); }}%>" fullword ascii

Detection condition:
uint16(0) == 0x253c and filesize < 1KB and 1 of ($x*) or 2 of them

Full rule:
rule WebShell_JexBoss_JSP_1 {
   meta:
      description = "Detects JexBoss JSPs"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2018-11-08"
      hash1 = "41e0fb374e5d30b2e2a362a2718a5bf16e73127e22f0dfc89fdb17acbe89efdf"
      id = "4fe7a20b-dc2b-509b-bcf8-e3bfbbe7431a"
   strings:
      $x1 = "equals(\"jexboss\")"
      $x2 = "%><pre><%if(request.getParameter(\"ppp\") != null &&" ascii

      $s1 = "<%@ page import=\"java.util.*,java.io.*\"%><pre><% if (request.getParameter(\""
      $s2 = "!= null && request.getHeader(\"user-agent\"" ascii
      $s3 = "String disr = dis.readLine(); while ( disr != null ) { out.println(disr); disr = dis.readLine(); }}%>" fullword ascii
   condition:
      uint16(0) == 0x253c and filesize < 1KB and 1 of ($x*) or 2 of them
}
YARA Detection Rule: WebShell_JexBoss_WAR_1
Repository: Neo23x0/signature-base
Detects: Detects JexBoss versions in WAR form
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$ = "jbossass" fullword ascii
      $ = "jexws.jsp" fullword ascii
      $ = "jexws.jspPK" fullword ascii
      $ = "jexws1.jsp" fullword ascii
      $ = "jexws1.jspPK" fullword ascii
      $ = "jexws2.jsp" fullword ascii
      $ = "jexws2.jspPK" fullword ascii
      $ = "jexws3.jsp" fullword ascii
      $ = "jexws3.jspPK" fullword ascii
      $ = "jexws4.jsp" fullword ascii
      $ = "jexws4.jspPK" fullword ascii

Detection condition:
uint16(0) == 0x4b50 and filesize < 4KB and 1 of them

Full rule:
rule WebShell_JexBoss_WAR_1 {
   meta:
      description = "Detects JexBoss versions in WAR form"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2018-11-08"
      hash1 = "6271775ab144ce9bb9138bf054b149b5813d3beb96338993c6de35330f566092"
      hash2 = "6f14a63c3034d3762da8b3ad4592a8209a0c88beebcb9f9bd11b40e879f74eaf"
      id = "0973f6cf-8a5f-5449-812e-36aa6b9939df"
   strings:
      $ = "jbossass" fullword ascii
      $ = "jexws.jsp" fullword ascii
      $ = "jexws.jspPK" fullword ascii
      $ = "jexws1.jsp" fullword ascii
      $ = "jexws1.jspPK" fullword ascii
      $ = "jexws2.jsp" fullword ascii
      $ = "jexws2.jspPK" fullword ascii
      $ = "jexws3.jsp" fullword ascii
      $ = "jexws3.jspPK" fullword ascii
      $ = "jexws4.jsp" fullword ascii
      $ = "jexws4.jspPK" fullword ascii
   condition:
      uint16(0) == 0x4b50 and filesize < 4KB and 1 of them
}
YARA Detection Rule: webshell_tinyasp
Repository: Neo23x0/signature-base
Detects: Detects 24 byte ASP webshell and variations
Author: Jeff Beley

Pattern signatures:
$s1 = "Execute Request" ascii wide nocase

Detection condition:
uint16(0) == 0x253c and filesize < 150 and 1 of them

Full rule:
rule webshell_tinyasp {
    meta:
	author = "Jeff Beley"
	hash1 = "1f29905348e136b66d4ff6c1494d6008ea13f9551ad5aa9b991893a31b37e452"
	description = "Detects 24 byte ASP webshell and variations"
	date = "2019-01-09"
	id = "38b1f61b-e506-59b2-9157-d0345431c429"
   strings:
   	$s1 = "Execute Request" ascii wide nocase
   condition:
   	uint16(0) == 0x253c and filesize < 150 and 1 of them
}
YARA Detection Rule: WEBSHELL_ASPX_Mar21_1
Repository: Neo23x0/signature-base
Detects: Detects ASPX Web Shells
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s1 = ".StartInfo.FileName = 'cmd.exe';" ascii
      $s2 = "<xsl:template match=\"\"/root\"\">" ascii fullword
      $s3 = "<?xml version=\"\"1.0\"\"?><root>test</root>\";" ascii fullword

Detection condition:
uint16(0) == 0x253c and
      filesize < 6KB and
      all of them

Full rule:
rule WEBSHELL_ASPX_Mar21_1 {
   meta:
      description = "Detects ASPX Web Shells"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2021-03-12"
      modified = "2025-11-03"
      hash1 = "10b6e82125a2ddf3cc31a238e0d0c71a64f902e0d[PII_REDACTED]3affede03174d"
      hash2 = "170bee832df176aac0a3c6c7d5aa3fee413b4572030a24c994a97e70f6648ffc"
      hash3 = "31c4d1fc81c052e269866deff324dffb215e7d481a47a2b6357a572a3e685d90"
      hash4 = "41b5c26ac194439612b68e9ec6a638eceaf00842c347ffa551eb009ef6c015a3"
      hash5 = "4b645bc773acde2b3cc204e77ac27c3f6991046c3b75f42d12bc90ec29cff9e3"
      hash6 = "602bb701b78895d4de32f5e78f3c511e5298ba244b29641b11a7c1c483789859"
      hash7 = "7ac47a17c511e25c06a53a1c7a5fbbf05f41f047a4a40b71afa81ce7b59f4b03"
      hash8 = "9a5097d0e8dc29a2814adac070c80fd4b149b33e56aaaf9235af9e87b0501d91"
      hash9 = "9efb5932c0753e45504fc9e8444209b92c2bdf22e63b1c1a44e2d52cb62b4548"
      hash10 = "d40b16307d6434c3281374c0e1bbc0f6db388883e7f6266c3c81de[PII_REDACTED]"
      id = "52884135-6b86-5e3e-a866-36a812d5a9af"
   strings:
      $s1 = ".StartInfo.FileName = 'cmd.exe';" ascii
      $s2 = "<xsl:template match=\"\"/root\"\">" ascii fullword
      $s3 = "<?xml version=\"\"1.0\"\"?><root>test</root>\";" ascii fullword
   condition:
      uint16(0) == 0x253c and
      filesize < 6KB and
      all of them
}