Detects webshell with mixed obfuscation commands

Hunt Hypothesis

This detection rule identifies adversaries deploying webshells that utilize mixed obfuscation commands to evade signature-based security controls and maintain persistent access within Azure Sentinel environments. Proactively hunting for this behavior is critical because obfuscated webshells often bypass standard alerts, allowing attackers to execute stealthy command-and-control operations before initiating lateral movement or data exfiltration.

YARA Rule

rule WEBSHELL_Mixed_OBFUSC {
   meta:
      description = "Detects webshell with mixed obfuscation commands"
      author = "Arnim Rupp (https://github.com/ruppde)"
      reference = "Internal Research"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      date = "2023-01-28"
      modified = "2023-04-05"
      hash1 = "8c4e5c6bdfcc86fa27bdfb075a7c9a769423ec6d53b73c80cbc71a6f8dd5aace"
      hash2 = "78f2086b6308315f5f0795aeaa75544128f14889a794205f5fc97d7ca639335b"
      hash3 = "3bca764d44074820618e1c831449168f220121698a7c82e9909f8eab2e297cbd"
      hash4 = "b26b5e5cba45482f486ff7c75b54c90b7d1957fd8e272ddb4b2488ec65a2936e"
      hash5 = "e217be2c533bfddbbdb6dc6a628e0d8756a217c3ddc083894e07fd3a7408756c"
      score = 50
      id = "dcb4054b-0c87-5cd0-9297-7fd5f2e37437"
   strings:
      $s1 = "rawurldecode/*" ascii
      $s2 = "preg_replace/*" ascii
      $s3 = " __FILE__/*" ascii
      $s4 = "strlen/*" ascii
      $s5 = "str_repeat/*" ascii
      $s6 = "basename/*" ascii
   condition:
      ( uint16(0) == 0x3f3c and filesize < 200KB and ( 4 of them ))
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

References

• Internal Research
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the “Detects webshell with mixed obfuscation commands” rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Backup Scripts Using PowerShell

  • Context: Enterprise backup solutions (e.g., Veeam, Commvault) often utilize PowerShell scripts that invoke Invoke-Expression or IEX combined with ConvertTo-SecureString to dynamically decrypt credentials before executing backup jobs. The YARA rule may flag the combination of these obfuscation commands as a webshell indicator.
  • Filter/Exclusion: Create an exclusion for processes running under specific service accounts (e.g., NT SERVICE\VeeamBackup) or filter on the command line containing keywords like “Veeam,” “Commvault,” or specific backup script paths (C:\Program Files\...\Scripts\backup.ps1).

• Scenario: Software Deployment via SCCM/Intune

  • Context: System Center Configuration Manager (SCCM) or Microsoft Intune frequently deploys applications using PowerShell scripts that download installers from internal repositories. These scripts often use Invoke-RestMethod wrapped in obfuscation logic to handle certificate validation and token decoding, triggering the mixed command detection.
  • Filter/Exclusion: Exclude execution paths belonging to known deployment agents (e.g., C:\Windows\CCM\, C:\Program Files (x86)\Microsoft Intune Agent\) or filter based on the parent process name (ccmsetup.exe or IntuneManagementAgent.exe).

• Scenario: Scheduled Compliance Reporting Jobs

  • Context: IT Audit teams run nightly compliance reports using tools like SolarWinds or custom Python/PowerShell wrappers. These jobs often fetch data from multiple endpoints, obfuscate sensitive PII fields in memory before aggregation, and