deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: webshell_iMHaPFtp_2
Repository: Yara-Rules/rules
Detects: Web Shell - file iMHaPFtp.php
Author: Florian Roth

Pattern signatures:
$s8 = "if ($l) echo '<a href=\"' . $self . '?action=permission&amp;file=' . urlencode($"
		$s9 = "return base64_decode('R0lGODlhEQANAJEDAMwAAP///5mZmf///yH5BAHoAwMALAAAAAARAA0AAA"

Detection condition:
1 of them

Full rule:
rule webshell_iMHaPFtp_2  : webshell{
	meta:
		description = "Web Shell - file iMHaPFtp.php"
		author = "Florian Roth"
		date = "2014/01/28"
		score = 70
		hash = "12911b73bc6a5d313b494102abcf5c57"
	strings:
		$s8 = "if ($l) echo '<a href=\"' . $self . '?action=permission&amp;file=' . urlencode($"
		$s9 = "return base64_decode('R0lGODlhEQANAJEDAMwAAP///5mZmf///yH5BAHoAwMALAAAAAARAA0AAA"
	condition:
		1 of them
}
YARA Detection Rule: webshell_Jspspyweb
Repository: Yara-Rules/rules
Detects: Web Shell - file Jspspyweb.jsp
Author: Florian Roth

Pattern signatures:
$s0 = "      out.print(\"<tr><td width='60%'>\"+strCut(convertPath(list[i].getPath()),7"
		$s3 = "  \"reg add \\\"HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Control"

Detection condition:
all of them

Full rule:
rule webshell_Jspspyweb  : webshell{
	meta:
		description = "Web Shell - file Jspspyweb.jsp"
		author = "Florian Roth"
		date = "2014/01/28"
		score = 70
		hash = "4e9be07e95fff820a9299f3fb4ace059"
	strings:
		$s0 = "      out.print(\"<tr><td width='60%'>\"+strCut(convertPath(list[i].getPath()),7"
		$s3 = "  \"reg add \\\"HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Control"
	condition:
		all of them
}
YARA Detection Rule: webshell_Safe_Mode_Bypass_PHP_4_4_2_and_PHP_5_1_2
Repository: Yara-Rules/rules
Detects: Web Shell - file Safe_Mode Bypass PHP 4.4.2 and PHP 5.1.2.php
Author: Florian Roth

Pattern signatures:
$s0 = "die(\"\\nWelcome.. By This script you can jump in the (Safe Mode=ON) .. Enjoy\\n"
		$s1 = "Mode Shell v1.0</font></span></a></font><font face=\"Webdings\" size=\"6\" color"

Detection condition:
1 of them

Full rule:
rule webshell_Safe_Mode_Bypass_PHP_4_4_2_and_PHP_5_1_2  : webshell{
	meta:
		description = "Web Shell - file Safe_Mode Bypass PHP 4.4.2 and PHP 5.1.2.php"
		author = "Florian Roth"
		date = "2014/01/28"
		score = 70
		hash = "49ad9117c96419c35987aaa7e2230f63"
	strings:
		$s0 = "die(\"\\nWelcome.. By This script you can jump in the (Safe Mode=ON) .. Enjoy\\n"
		$s1 = "Mode Shell v1.0</font></span></a></font><font face=\"Webdings\" size=\"6\" color"
	condition:
		1 of them
}
YARA Detection Rule: webshell_SimAttacker_Vrsion_1_0_0_priv8_4_My_friend
Repository: Yara-Rules/rules
Detects: Web Shell - file SimAttacker - Vrsion 1.0.0 - priv8 4 My friend.php
Author: Florian Roth

Pattern signatures:
$s2 = "echo \"<a href='?id=fm&fchmod=$dir$file'><span style='text-decoration: none'><fo"
		$s3 = "fputs ($fp ,\"\\n*********************************************\\nWelcome T0 Sim"

Detection condition:
1 of them

Full rule:
rule webshell_SimAttacker_Vrsion_1_0_0_priv8_4_My_friend  : webshell{
	meta:
		description = "Web Shell - file SimAttacker - Vrsion 1.0.0 - priv8 4 My friend.php"
		author = "Florian Roth"
		date = "2014/01/28"
		score = 70
		hash = "089ff24d978aeff2b4b2869f0c7d38a3"
	strings:
		$s2 = "echo \"<a href='?id=fm&fchmod=$dir$file'><span style='text-decoration: none'><fo"
		$s3 = "fputs ($fp ,\"\\n*********************************************\\nWelcome T0 Sim"
	condition:
		1 of them
}
YARA Detection Rule: webshell_phpshell_2_1_pwhash
Repository: Yara-Rules/rules
Detects: Web Shell - file pwhash.php
Author: Florian Roth

Pattern signatures:
$s1 = "<tt>&nbsp;</tt>\" (space), \"<tt>[</tt>\" (left bracket), \"<tt>|</tt>\" (pi"
		$s3 = "word: \"<tt>null</tt>\", \"<tt>yes</tt>\", \"<tt>no</tt>\", \"<tt>true</tt>\","

Detection condition:
1 of them

Full rule:
rule webshell_phpshell_2_1_pwhash  : webshell{
	meta:
		description = "Web Shell - file pwhash.php"
		author = "Florian Roth"
		date = "2014/01/28"
		score = 70
		hash = "ba120abac165a5a30044428fac1970d8"
	strings:
		$s1 = "<tt>&nbsp;</tt>\" (space), \"<tt>[</tt>\" (left bracket), \"<tt>|</tt>\" (pi"
		$s3 = "word: \"<tt>null</tt>\", \"<tt>yes</tt>\", \"<tt>no</tt>\", \"<tt>true</tt>\","
	condition:
		1 of them
}
YARA Detection Rule: webshell_PHPRemoteView
Repository: Yara-Rules/rules
Detects: Web Shell - file PHPRemoteView.php
Author: Florian Roth

Pattern signatures:
$s2 = "<input type=submit value='\".mm(\"Delete all dir/files recursive\").\" (rm -fr)'"
		$s4 = "<a href='$self?c=delete&c2=$c2&confirm=delete&d=\".urlencode($d).\"&f=\".u"

Detection condition:
1 of them

Full rule:
rule webshell_PHPRemoteView  : webshell{
	meta:
		description = "Web Shell - file PHPRemoteView.php"
		author = "Florian Roth"
		date = "2014/01/28"
		score = 70
		hash = "29420106d9a81553ef0d1ca72b9934d9"
	strings:
		$s2 = "<input type=submit value='\".mm(\"Delete all dir/files recursive\").\" (rm -fr)'"
		$s4 = "<a href='$self?c=delete&c2=$c2&confirm=delete&d=\".urlencode($d).\"&f=\".u"
	condition:
		1 of them
}
YARA Detection Rule: webshell_jsp_12302
Repository: Yara-Rules/rules
Detects: Web Shell - file 12302.jsp
Author: Florian Roth

Pattern signatures:
$s0 = "</font><%out.print(request.getRealPath(request.getServletPath())); %>" fullword
		$s1 = "<%@page import=\"java.io.*,java.util.*,java.net.*\"%>" fullword
		$s4 = "String path=new String(request.getParameter(\"path\").getBytes(\"ISO-8859-1\""

Detection condition:
all of them

Full rule:
rule webshell_jsp_12302  : webshell{
	meta:
		description = "Web Shell - file 12302.jsp"
		author = "Florian Roth"
		date = "2014/01/28"
		score = 70
		hash = "a3930518ea57d899457a62f372205f7f"
	strings:
		$s0 = "</font><%out.print(request.getRealPath(request.getServletPath())); %>" fullword
		$s1 = "<%@page import=\"java.io.*,java.util.*,java.net.*\"%>" fullword
		$s4 = "String path=new String(request.getParameter(\"path\").getBytes(\"ISO-8859-1\""
	condition:
		all of them
}
YARA Detection Rule: webshell_caidao_shell_guo
Repository: Yara-Rules/rules
Detects: Web Shell - file guo.php
Author: Florian Roth

Pattern signatures:
$s0 = "<?php ($www= $_POST['ice'])!"
		$s1 = "@preg_replace('/ad/e','@'.str_rot13('riny').'($ww"

Detection condition:
1 of them

Full rule:
rule webshell_caidao_shell_guo  : webshell{
	meta:
		description = "Web Shell - file guo.php"
		author = "Florian Roth"
		date = "2014/01/28"
		score = 70
		hash = "9e69a8f499c660ee0b4796af14dc08f0"
	strings:
		$s0 = "<?php ($www= $_POST['ice'])!"
		$s1 = "@preg_replace('/ad/e','@'.str_rot13('riny').'($ww"
	condition:
		1 of them
}
YARA Detection Rule: webshell_PHP_redcod
Repository: Yara-Rules/rules
Detects: Web Shell - file redcod.php
Author: Florian Roth

Pattern signatures:
$s0 = "H8p0bGFOEy7eAly4h4E4o88LTSVHoAglJ2KLQhUw" fullword
		$s1 = "HKP7dVyCf8cgnWFy8ocjrP5ffzkn9ODroM0/raHm" fullword

Detection condition:
all of them

Full rule:
rule webshell_PHP_redcod  : webshell{
	meta:
		description = "Web Shell - file redcod.php"
		author = "Florian Roth"
		date = "2014/01/28"
		score = 70
		hash = "5c1c8120d82f46ff9d813fbe3354bac5"
	strings:
		$s0 = "H8p0bGFOEy7eAly4h4E4o88LTSVHoAglJ2KLQhUw" fullword
		$s1 = "HKP7dVyCf8cgnWFy8ocjrP5ffzkn9ODroM0/raHm" fullword
	condition:
		all of them
}
YARA Detection Rule: webshell_remview_fix
Repository: Yara-Rules/rules
Detects: Web Shell - file remview_fix.php
Author: Florian Roth

Pattern signatures:
$s4 = "<a href='$self?c=delete&c2=$c2&confirm=delete&d=\".urlencode($d).\"&f=\".u"
		$s5 = "echo \"<P><hr size=1 noshade>\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n"

Detection condition:
1 of them

Full rule:
rule webshell_remview_fix  : webshell{
	meta:
		description = "Web Shell - file remview_fix.php"
		author = "Florian Roth"
		date = "2014/01/28"
		score = 70
		hash = "a24b7c492f5f00e2a19b0fa2eb9c3697"
	strings:
		$s4 = "<a href='$self?c=delete&c2=$c2&confirm=delete&d=\".urlencode($d).\"&f=\".u"
		$s5 = "echo \"<P><hr size=1 noshade>\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n"
	condition:
		1 of them
}
YARA Detection Rule: webshell_asp_cmd
Repository: Yara-Rules/rules
Detects: Web Shell - file cmd.asp
Author: Florian Roth

Pattern signatures:
$s0 = "<%= \"\\\\\" & oScriptNet.ComputerName & \"\\\" & oScriptNet.UserName %>" fullword
		$s1 = "Set oFileSys = Server.CreateObject(\"Scripting.FileSystemObject\")" fullword
		$s3 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)" fullword

Detection condition:
1 of them

Full rule:
rule webshell_asp_cmd : webshell {
	meta:
		description = "Web Shell - file cmd.asp"
		author = "Florian Roth"
		date = "2014/01/28"
		score = 70
		hash = "895ca846858c315a3ff8daa7c55b3119"
	strings:
		$s0 = "<%= \"\\\\\" & oScriptNet.ComputerName & \"\\\" & oScriptNet.UserName %>" fullword
		$s1 = "Set oFileSys = Server.CreateObject(\"Scripting.FileSystemObject\")" fullword
		$s3 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)" fullword
	condition:
		1 of them
}
YARA Detection Rule: webshell_php_sh_server
Repository: Yara-Rules/rules
Detects: Web Shell - file server.php
Author: Florian Roth

Pattern signatures:
$s0 = "eval(getenv('HTTP_CODE'));" fullword

Detection condition:
all of them

Full rule:
rule webshell_php_sh_server : webshell {
	meta:
		description = "Web Shell - file server.php"
		author = "Florian Roth"
		date = "2014/01/28"
		score = 50
		hash = "d87b019e74064aa90e2bb143e5e16cfa"
	strings:
		$s0 = "eval(getenv('HTTP_CODE'));" fullword
	condition:
		all of them
}
YARA Detection Rule: webshell_PH_Vayv_PH_Vayv
Repository: Yara-Rules/rules
Detects: Web Shell - file PH Vayv.php
Author: Florian Roth

Pattern signatures:
$s0 = "style=\"BACKGROUND-COLOR: #eae9e9; BORDER-BOTTOM: #000000 1px in"
		$s4 = "<font color=\"#858585\">SHOPEN</font></a></font><font face=\"Verdana\" style"

Detection condition:
1 of them

Full rule:
rule webshell_PH_Vayv_PH_Vayv : webshell {
	meta:
		description = "Web Shell - file PH Vayv.php"
		author = "Florian Roth"
		date = "2014/01/28"
		score = 70
		hash = "35fb37f3c806718545d97c6559abd262"
	strings:
		$s0 = "style=\"BACKGROUND-COLOR: #eae9e9; BORDER-BOTTOM: #000000 1px in"
		$s4 = "<font color=\"#858585\">SHOPEN</font></a></font><font face=\"Verdana\" style"
	condition:
		1 of them
}
YARA Detection Rule: webshell_caidao_shell_ice
Repository: Yara-Rules/rules
Detects: Web Shell - file ice.asp
Author: Florian Roth

Pattern signatures:
$s0 = "<%eval request(\"ice\")%>" fullword

Detection condition:
all of them

Full rule:
rule webshell_caidao_shell_ice  : webshell{
	meta:
		description = "Web Shell - file ice.asp"
		author = "Florian Roth"
		date = "2014/01/28"
		score = 70
		hash = "6560b436d3d3bb75e2ef3f032151d139"
	strings:
		$s0 = "<%eval request(\"ice\")%>" fullword
	condition:
		all of them
}
YARA Detection Rule: webshell_cihshell_fix
Repository: Yara-Rules/rules
Detects: Web Shell - file cihshell_fix.php
Author: Florian Roth

Pattern signatures:
$s7 = "<tr style='background:#242424;' ><td style='padding:10px;'><form action='' encty"
		$s8 = "if (isset($_POST['mysqlw_host'])){$dbhost = $_POST['mysqlw_host'];} else {$dbhos"

Detection condition:
1 of them

Full rule:
rule webshell_cihshell_fix : webshell {
	meta:
		description = "Web Shell - file cihshell_fix.php"
		author = "Florian Roth"
		date = "2014/01/28"
		score = 70
		hash = "3823ac218032549b86ee7c26f10c4cb5"
	strings:
		$s7 = "<tr style='background:#242424;' ><td style='padding:10px;'><form action='' encty"
		$s8 = "if (isset($_POST['mysqlw_host'])){$dbhost = $_POST['mysqlw_host'];} else {$dbhos"
	condition:
		1 of them
}
YARA Detection Rule: webshell_asp_shell
Repository: Yara-Rules/rules
Detects: Web Shell - file shell.asp
Author: Florian Roth

Pattern signatures:
$s7 = "<input type=\"submit\" name=\"Send\" value=\"GO!\">" fullword
		$s8 = "<TEXTAREA NAME=\"1988\" ROWS=\"18\" COLS=\"78\"></TEXTAREA>" fullword

Detection condition:
all of them

Full rule:
rule webshell_asp_shell : webshell {
	meta:
		description = "Web Shell - file shell.asp"
		author = "Florian Roth"
		date = "2014/01/28"
		score = 70
		hash = "e63f5a96570e1faf4c7b8ca6df750237"
	strings:
		$s7 = "<input type=\"submit\" name=\"Send\" value=\"GO!\">" fullword
		$s8 = "<TEXTAREA NAME=\"1988\" ROWS=\"18\" COLS=\"78\"></TEXTAREA>" fullword
	condition:
		all of them
}
YARA Detection Rule: webshell_Private_i3lue
Repository: Yara-Rules/rules
Detects: Web Shell - file Private-i3lue.php
Author: Florian Roth

Pattern signatures:
$s8 = "case 15: $image .= \"\\21\\0\\"

Detection condition:
all of them

Full rule:
rule webshell_Private_i3lue  : webshell{
	meta:
		description = "Web Shell - file Private-i3lue.php"
		author = "Florian Roth"
		date = "2014/01/28"
		score = 70
		hash = "13f5c7a035ecce5f9f380967cf9d4e92"
	strings:
		$s8 = "case 15: $image .= \"\\21\\0\\"
	condition:
		all of them
}
YARA Detection Rule: webshell_php_up
Repository: Yara-Rules/rules
Detects: Web Shell - file up.php
Author: Florian Roth

Pattern signatures:
$s0 = "copy($HTTP_POST_FILES['userfile']['tmp_name'], $_POST['remotefile']);" fullword
		$s3 = "if(is_uploaded_file($HTTP_POST_FILES['userfile']['tmp_name'])) {" fullword
		$s8 = "echo \"Uploaded file: \" . $HTTP_POST_FILES['userfile']['name'];" fullword

Detection condition:
2 of them

Full rule:
rule webshell_php_up : webshell {
	meta:
		description = "Web Shell - file up.php"
		author = "Florian Roth"
		date = "2014/01/28"
		score = 70
		hash = "7edefb8bd0876c41906f4b39b52cd0ef"
	strings:
		$s0 = "copy($HTTP_POST_FILES['userfile']['tmp_name'], $_POST['remotefile']);" fullword
		$s3 = "if(is_uploaded_file($HTTP_POST_FILES['userfile']['tmp_name'])) {" fullword
		$s8 = "echo \"Uploaded file: \" . $HTTP_POST_FILES['userfile']['name'];" fullword
	condition:
		2 of them
}
YARA Detection Rule: webshell_Mysql_interface_v1_0
Repository: Yara-Rules/rules
Detects: Web Shell - file Mysql interface v1.0.php
Author: Florian Roth

Pattern signatures:
$s0 = "echo \"<td><a href='$PHP_SELF?action=dropDB&dbname=$dbname' onClick=\\\"return"

Detection condition:
all of them

Full rule:
rule webshell_Mysql_interface_v1_0 {
	meta:
		description = "Web Shell - file Mysql interface v1.0.php"
		author = "Florian Roth"
		date = "2014/01/28"
		score = 70
		hash = "a12fc0a3d31e2f89727b9678148cd487"
	strings:
		$s0 = "echo \"<td><a href='$PHP_SELF?action=dropDB&dbname=$dbname' onClick=\\\"return"
	condition:
		all of them
}
YARA Detection Rule: webshell_php_s_u
Repository: Yara-Rules/rules
Detects: Web Shell - file s-u.php
Author: Florian Roth

Pattern signatures:
$s6 = "<a href=\"?act=do\"><font color=\"red\">Go Execute</font></a></b><br /><textarea"

Detection condition:
all of them

Full rule:
rule webshell_php_s_u {
	meta:
		description = "Web Shell - file s-u.php"
		author = "Florian Roth"
		date = "2014/01/28"
		score = 70
		hash = "efc7ba1a4023bcf40f5e912f1dd85b5a"
	strings:
		$s6 = "<a href=\"?act=do\"><font color=\"red\">Go Execute</font></a></b><br /><textarea"
	condition:
		all of them
}
YARA Detection Rule: webshell_phpshell_2_1_config
Repository: Yara-Rules/rules
Detects: Web Shell - file config.php
Author: Florian Roth

Pattern signatures:
$s1 = "; (choose good passwords!).  Add uses as simple 'username = \"password\"' lines." fullword

Detection condition:
all of them

Full rule:
rule webshell_phpshell_2_1_config {
	meta:
		description = "Web Shell - file config.php"
		author = "Florian Roth"
		date = "2014/01/28"
		score = 70
		hash = "bd83144a649c5cc21ac41b505a36a8f3"
	strings:
		$s1 = "; (choose good passwords!).  Add uses as simple 'username = \"password\"' lines." fullword
	condition:
		all of them
}
YARA Detection Rule: webshell_asp_EFSO_2
Repository: Yara-Rules/rules
Detects: Web Shell - file EFSO_2.asp
Author: Florian Roth

Pattern signatures:
$s0 = "%8@#@&P~,P,PP,MV~4BP^~,NS~m~PXc3,_PWbSPU W~~[u3Fffs~/%@#@&~~,PP~~,M!PmS,4S,mBPNB"

Detection condition:
all of them

Full rule:
rule webshell_asp_EFSO_2 {
	meta:
		description = "Web Shell - file EFSO_2.asp"
		author = "Florian Roth"
		date = "2014/01/28"
		score = 70
		hash = "a341270f9ebd01320a7490c12cb2e64c"
	strings:
		$s0 = "%8@#@&P~,P,PP,MV~4BP^~,NS~m~PXc3,_PWbSPU W~~[u3Fffs~/%@#@&~~,PP~~,M!PmS,4S,mBPNB"
	condition:
		all of them
}
YARA Detection Rule: webshell_jsp_up
Repository: Yara-Rules/rules
Detects: Web Shell - file up.jsp
Author: Florian Roth

Pattern signatures:
$s9 = "// BUG: Corta el fichero si es mayor de 640Ks" fullword

Detection condition:
all of them

Full rule:
rule webshell_jsp_up {
	meta:
		description = "Web Shell - file up.jsp"
		author = "Florian Roth"
		date = "2014/01/28"
		score = 70
		hash = "515a5dd86fe48f673b72422cccf5a585"
	strings:
		$s9 = "// BUG: Corta el fichero si es mayor de 640Ks" fullword
	condition:
		all of them
}
YARA Detection Rule: webshell_NetworkFileManagerPHP
Repository: Yara-Rules/rules
Detects: Web Shell - file NetworkFileManagerPHP.php
Author: Florian Roth

Pattern signatures:
$s9 = "  echo \"<br><center>All the data in these tables:<br> \".$tblsv.\" were putted "

Detection condition:
all of them

Full rule:
rule webshell_NetworkFileManagerPHP {
	meta:
		description = "Web Shell - file NetworkFileManagerPHP.php"
		author = "Florian Roth"
		date = "2014/01/28"
		score = 70
		hash = "acdbba993a5a4186fd864c5e4ea0ba4f"
	strings:
		$s9 = "  echo \"<br><center>All the data in these tables:<br> \".$tblsv.\" were putted "
	condition:
		all of them
}
YARA Detection Rule: webshell_Server_Variables
Repository: Yara-Rules/rules
Detects: Web Shell - file Server Variables.asp
Author: Florian Roth

Pattern signatures:
$s7 = "<% For Each Vars In Request.ServerVariables %>" fullword
		$s9 = "Variable Name</B></font></p>" fullword

Detection condition:
all of them

Full rule:
rule webshell_Server_Variables {
	meta:
		description = "Web Shell - file Server Variables.asp"
		author = "Florian Roth"
		date = "2014/01/28"
		score = 70
		hash = "47fb8a647e441488b30f92b4d39003d7"
	strings:
		$s7 = "<% For Each Vars In Request.ServerVariables %>" fullword
		$s9 = "Variable Name</B></font></p>" fullword
	condition:
		all of them
}
YARA Detection Rule: webshell_caidao_shell_ice_2
Repository: Yara-Rules/rules
Detects: Web Shell - file ice.php
Author: Florian Roth

Pattern signatures:
$s0 = "<?php ${${eval($_POST[ice])}};?>" fullword

Detection condition:
all of them

Full rule:
rule webshell_caidao_shell_ice_2 {
	meta:
		description = "Web Shell - file ice.php"
		author = "Florian Roth"
		date = "2014/01/28"
		score = 70
		hash = "1d6335247f58e0a5b03e17977888f5f2"
	strings:
		$s0 = "<?php ${${eval($_POST[ice])}};?>" fullword
	condition:
		all of them
}
YARA Detection Rule: webshell_caidao_shell_mdb
Repository: Yara-Rules/rules
Detects: Web Shell - file mdb.asp
Author: Florian Roth

Pattern signatures:
$s1 = "<% execute request(\"ice\")%>a " fullword

Detection condition:
all of them

Full rule:
rule webshell_caidao_shell_mdb {
	meta:
		description = "Web Shell - file mdb.asp"
		author = "Florian Roth"
		date = "2014/01/28"
		score = 70
		hash = "fbf3847acef4844f3a0d04230f6b9ff9"
	strings:
		$s1 = "<% execute request(\"ice\")%>a " fullword
	condition:
		all of them
}
YARA Detection Rule: webshell_jsp_guige
Repository: Yara-Rules/rules
Detects: Web Shell - file guige.jsp
Author: Florian Roth

Pattern signatures:
$s0 = "if(damapath!=null &&!damapath.equals(\"\")&&content!=null"

Detection condition:
all of them

Full rule:
rule webshell_jsp_guige {
	meta:
		description = "Web Shell - file guige.jsp"
		author = "Florian Roth"
		date = "2014/01/28"
		score = 70
		hash = "2c9f2dafa[PII_REDACTED]7e2c713aacdd2"
	strings:
		$s0 = "if(damapath!=null &&!damapath.equals(\"\")&&content!=null"
	condition:
		all of them
}
YARA Detection Rule: webshell_phpspy2010
Repository: Yara-Rules/rules
Detects: Web Shell - file phpspy2010.php
Author: Florian Roth

Pattern signatures:
$s3 = "eval(gzinflate(base64_decode("
		$s5 = "//angel" fullword
		$s8 = "$admin['cookiedomain'] = '';" fullword

Detection condition:
all of them

Full rule:
rule webshell_phpspy2010 {
	meta:
		description = "Web Shell - file phpspy2010.php"
		author = "Florian Roth"
		date = "2014/01/28"
		score = 70
		hash = "14ae0e4f5349924a5047fed9f3b105c5"
	strings:
		$s3 = "eval(gzinflate(base64_decode("
		$s5 = "//angel" fullword
		$s8 = "$admin['cookiedomain'] = '';" fullword
	condition:
		all of them
}
YARA Detection Rule: webshell_asp_ice
Repository: Yara-Rules/rules
Detects: Web Shell - file ice.asp
Author: Florian Roth

Pattern signatures:
$s0 = "D,'PrjknD,J~[,EdnMP[,-4;DS6@#@&VKobx2ldd,'~JhC"

Detection condition:
all of them

Full rule:
rule webshell_asp_ice {
	meta:
		description = "Web Shell - file ice.asp"
		author = "Florian Roth"
		date = "2014/01/28"
		score = 70
		hash = "d141e011a92f48da72728c35f1934a2b"
	strings:
		$s0 = "D,'PrjknD,J~[,EdnMP[,-4;DS6@#@&VKobx2ldd,'~JhC"
	condition:
		all of them
}
YARA Detection Rule: webshell_drag_system
Repository: Yara-Rules/rules
Detects: Web Shell - file system.jsp
Author: Florian Roth

Pattern signatures:
$s9 = "String sql = \"SELECT * FROM DBA_TABLES WHERE TABLE_NAME not like '%$%' and num_"

Detection condition:
all of them

Full rule:
rule webshell_drag_system {
	meta:
		description = "Web Shell - file system.jsp"
		author = "Florian Roth"
		date = "2014/01/28"
		score = 70
		hash = "15ae237cf395fb24cf12bff141fb3f7c"
	strings:
		$s9 = "String sql = \"SELECT * FROM DBA_TABLES WHERE TABLE_NAME not like '%$%' and num_"
	condition:
		all of them
}
YARA Detection Rule: webshell_DarkBlade1_3_asp_indexx
Repository: Yara-Rules/rules
Detects: Web Shell - file indexx.asp
Author: Florian Roth

Pattern signatures:
$s3 = "Const strs_toTransform=\"command|Radmin|NTAuThenabled|FilterIp|IISSample|PageCou"

Detection condition:
all of them

Full rule:
rule webshell_DarkBlade1_3_asp_indexx {
	meta:
		description = "Web Shell - file indexx.asp"
		author = "Florian Roth"
		date = "2014/01/28"
		score = 70
		hash = "b7f46693648f534c2ca78e3f21685707"
	strings:
		$s3 = "Const strs_toTransform=\"command|Radmin|NTAuThenabled|FilterIp|IISSample|PageCou"
	condition:
		all of them
}
YARA Detection Rule: webshell_phpshell3
Repository: Yara-Rules/rules
Detects: Web Shell - file phpshell3.php
Author: Florian Roth

Pattern signatures:
$s2 = "<input name=\"nounce\" type=\"hidden\" value=\"<?php echo $_SESSION['nounce'];"
		$s5 = "<p>Username: <input name=\"username\" type=\"text\" value=\"<?php echo $userna"
		$s7 = "$_SESSION['output'] .= \"cd: could not change to: $new_dir\\n\";" fullword

Detection condition:
2 of them

Full rule:
rule webshell_phpshell3 {
	meta:
		description = "Web Shell - file phpshell3.php"
		author = "Florian Roth"
		date = "2014/01/28"
		score = 70
		hash = "76117b2ee4a7ac06832d50b2d04070b8"
	strings:
		$s2 = "<input name=\"nounce\" type=\"hidden\" value=\"<?php echo $_SESSION['nounce'];"
		$s5 = "<p>Username: <input name=\"username\" type=\"text\" value=\"<?php echo $userna"
		$s7 = "$_SESSION['output'] .= \"cd: could not change to: $new_dir\\n\";" fullword
	condition:
		2 of them
}
YARA Detection Rule: webshell_jsp_hsxa
Repository: Yara-Rules/rules
Detects: Web Shell - file hsxa.jsp
Author: Florian Roth

Pattern signatures:
$s0 = "<%@ page language=\"java\" pageEncoding=\"gbk\"%><jsp:directive.page import=\"ja"

Detection condition:
all of them

Full rule:
rule webshell_jsp_hsxa {
	meta:
		description = "Web Shell - file hsxa.jsp"
		author = "Florian Roth"
		date = "2014/01/28"
		score = 70
		hash = "d0e05f9c9b8e0b3fa11f57d9ab800380"
	strings:
		$s0 = "<%@ page language=\"java\" pageEncoding=\"gbk\"%><jsp:directive.page import=\"ja"
	condition:
		all of them
}
YARA Detection Rule: webshell_jsp_utils
Repository: Yara-Rules/rules
Detects: Web Shell - file utils.jsp
Author: Florian Roth

Pattern signatures:
$s0 = "ResultSet r = c.getMetaData().getTables(null, null, \"%\", t);" fullword
		$s4 = "String cs = request.getParameter(\"z0\")==null?\"gbk\": request.getParameter(\"z"

Detection condition:
all of them

Full rule:
rule webshell_jsp_utils {
	meta:
		description = "Web Shell - file utils.jsp"
		author = "Florian Roth"
		date = "2014/01/28"
		score = 70
		hash = "9827ba2e[PII_REDACTED]b8e8a53e20d545"
	strings:
		$s0 = "ResultSet r = c.getMetaData().getTables(null, null, \"%\", t);" fullword
		$s4 = "String cs = request.getParameter(\"z0\")==null?\"gbk\": request.getParameter(\"z"
	condition:
		all of them
}