EXT_WEBSHELL_PHP_Generic

rule EXT_WEBSHELL_PHP_Generic {
   meta:
      description = "php webshell having some kind of input and some kind of payload. restricted to small files or big ones including suspicious strings"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Arnim Rupp (https://github.com/ruppde)"
      reference = "Internal Research"
      score = 70
      date = "2021-01-14"
      modified = "2026-03-09"
      hash = "bee1b76b1455105d4bfe2f45191071cf05e83a309ae9defcf759248ca9bceddd"
      hash = "6bf351900a408120bee3fc6ea39905c6a35fe6efcf35d0a783ee92062e63a854"
      hash = "e3b4e5ec29628791f836e15500f6fdea19beaf3e8d9981c50714656c50d3b365"
      hash = "00813155bf7f5eb441e1619616a5f6b21ae31afc99caa000c4aafd54b46c3597"
      hash = "e31788042d9cdeffcb279533b5a7359b3beb1144f39bacdd3acdef6e9b4aff25"
      hash = "36b91575a08cf40d4782e5aebcec2894144f1e236a102edda2416bc75cbac8dd"
      hash = "a34154af7c0d7157285cfa498734cfb77662edadb1a10892eb7f7e2fb5e2486c"
      hash = "791a882af2cea0aa8b8379791b401bebc235296858266ddb7f881c8923b7ea61"
      hash = "9a8ab3c225076a26309230d7eac7681f85b271d2db22bf5a190adbf66faca2e6"
      hash = "0d3ee83adc9ebf8fb1a8c449eed5547ee5e67e9a416cce25592e80963198ae23"
      hash = "3d8708609562a27634df5094713154d8ca784dbe89738e63951e12184ff07ad6"
      hash = "70d64d987f0d9ab46514abcc868505d95dbf458387f858b0d7580e4ee8573786"
      hash = "259b3828694b4d256764d7d01b0f0f36ca0526d5ee75e134c6a754d2ab0d1caa"
      hash = "04d139b48d59fa2ef24fb9347b74fa317cb05bd8b7389aeb0a4d458c49ea7540"
      hash = "58d0e2ff61301fe0c176b51430850239d3278c7caf56310d202e0cdbdde9ac3f"
      hash = "731f36a08b0e63c63b3a2a457667dfc34aa7ff3a2aee24e60a8d16b83ad44ce2"
      hash = "e4ffd4ec67762fe00bb8bd9fbff78cffefdb96c16fe7551b5505d319a90fa18f"
      hash = "fa00ee25bfb3908808a7c6e8b2423c681d7c52de2deb30cbaea2ee09a635b7d4"
      hash = "98c1937b9606b1e8e0eebcb116a784c9d2d3db0039b21c45cba399e86c92c2fa"
      hash = "e9423ad8e51895db0e8422750c61ef4897b3be4292b36dba67d42de99e714bff"
      hash = "7a16311a371f03b29d5220484e7ecbe841cfaead4e73c17aa6a9c23b5d94544d"
      hash = "7ca5dec0515dd6f401cb5a52c313f41f5437fc43eb62ea4bcc415a14212d09e9"
      hash = "3de8c04bfdb24185a07f198464fcdd56bb643e1d08199a26acee51435ff0a99f"
      hash = "63297f8c1d4e88415bc094bc5546124c9ed8d57aca3a09e36ae18f5f054ad172"
      hash = "a09dcf52da767815f29f66cb7b03f3d8c102da5cf7b69567928961c389eac11f"
      hash = "d9ae762b011216e520ebe4b7abcac615c61318a8195601526cfa11bbc719a8f1"
      hash = "dd5d8a9b4bb406e0b8f868165a1714fe54ffb18e621582210f96f6e5ae850b33"
      id = "ce3c93a5-3088-5e7e-a0d4-8bea18cf9cc3"
   strings:
      $wfp_tiny1 = "escapeshellarg" fullword
      $wfp_tiny2 = "addslashes" fullword

      //strings from private rule php_false_positive_tiny
      // try to use only strings which would be flagged by themselves as suspicious by other rules, e.g. eval
      //$gfp_tiny1 = "addslashes" fullword
      //$gfp_tiny2 = "escapeshellarg" fullword
      $gfp_tiny3 = "include \"./common.php\";"  // xcache
      $gfp_tiny4 = "assert('FALSE');"
      $gfp_tiny5 = "assert(false);"
      $gfp_tiny6 = "assert(FALSE);"
      $gfp_tiny7 = "assert('array_key_exists("
      $gfp_tiny8 = "echo shell_exec($aspellcommand . ' 2>&1');"
      $gfp_tiny9 = "throw new Exception('Could not find authentication source with id ' . $sourceId);"
      $gfp_tiny10 = "return isset( $_POST[ $key ] ) ? $_POST[ $key ] : ( isset( $_REQUEST[ $key ] ) ? $_REQUEST[ $key ] : $default );"
      $gfp_tiny11 = "; This is the recommended, PHP 4-style version of the php.ini-dist file"

      //strings from private rule capa_php_old_safe
      $php_short = "<?" wide ascii
      // prevent xml and asp from hitting with the short tag
      $no_xml1 = "<?xml version" nocase wide ascii
      $no_xml2 = "<?xml-stylesheet" nocase wide ascii
      $no_asp1 = "<%@LANGUAGE" nocase wide ascii
      $no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
      $no_pdf = "<?xpacket"

      // of course the new tags should also match
      // already matched by "<?"
      $php_new1 = /<\?=[^?]/ wide ascii
      $php_new2 = "<?php" nocase wide ascii
      $php_new3 = "<script language=\"php" nocase wide ascii

      //strings from private rule capa_php_input
      $inp1 = "php://input" wide ascii
      $inp2 = /_GET\s?\[/ wide ascii
      // for passing $_GET to a function
      $inp3 = /\(\s?\$_GET\s?\)/ wide ascii
      $inp4 = /_POST\s?\[/ wide ascii
      $inp5 = /\(\s?\$_POST\s?\)/ wide ascii
      $inp6 = /_REQUEST\s?\[/ wide ascii
      $inp7 = /\(\s?\$_REQUEST\s?\)/ wide ascii
      $inp8 = /\(\s?\$_HEADERS\s?[\)\[]/ wide ascii
      // PHP automatically adds all the request headers into the $_SERVER global array, prefixing each header name by the "HTTP_" string, so e.g. @eval($_SERVER['HTTP_CMD']) will run any code in the HTTP header CMD
      $inp15 = "_SERVER['HTTP_" wide ascii
      $inp16 = "_SERVER[\"HTTP_" wide ascii
      $inp17 = /getenv[\t ]{0,20}\([\t ]{0,20}['"]HTTP_/ wide ascii
      $inp18 = "array_values($_SERVER)" wide ascii
      $inp19 = /file_get_contents\("https?:\/\// wide ascii
      $inp20 = "TSOP_" wide ascii

      //strings from private rule capa_php_payload
      // \([^)] to avoid matching on e.g. eval() in comments
      $cpayload1 = /\beval[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
      $cpayload2 = /\bexec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
      $cpayload3 = /\bshell_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
      $cpayload4 = /\bpassthru[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
      $cpayload5 = /\bsystem[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
      $cpayload6 = /\bpopen[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
      $cpayload7 = /\bproc_open[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
      $cpayload8 = /\bpcntl_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
      $cpayload9 = /\bassert[\n\t ]{0,500}\([^)0]/ nocase wide ascii
      $cpayload10 = /\bpreg_replace[\n\t ]{0,500}\([^\)]{1,100}\/[ismxADSUXju]{0,11}(e|\\x65)/ nocase wide ascii
      $cpayload12 = /\bmb_ereg_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
      $cpayload13 = /\bmb_eregi_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
      $cpayload20 = /\bcreate_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
      $cpayload21 = /\bReflectionFunction[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
      $cpayload22 = /fetchall\(PDO::FETCH_FUNC[\n\t ]{0,500}[,}