Generic PHP webshell which uses backticks directly on user input

Hunt Hypothesis

This detection identifies a PHP webshell that executes untrusted user input via backticks, a common vulnerability allowing adversaries to inject and run arbitrary commands for remote code execution. Proactively hunting for this behavior in Azure Sentinel is critical because such webshells often serve as the initial foothold for attackers to establish persistence and pivot within the environment before triggering broader alerts.

YARA Rule

rule WEBSHELL_PHP_Generic_Backticks
{
    meta:
        description = "Generic PHP webshell which uses backticks directly on user input"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        reference = "Internal Research"
        score = 75
        date = "2021/01/07"
        modified = "2023-04-05"
        hash = "339f32c883f6175233f0d1a30510caa52fdcaa37"
        hash = "8db86ad90883cd208cf86acd45e67c03f994998804441705d690cb6526614d00"
        hash = "af987b0eade03672c30c095cee0c7c00b663e4b3c6782615fb7e430e4a7d1d75"
        hash = "67339f9e70a17af16cf51686918cbe1c0604e129950129f67fe445eaff4b4b82"
        hash = "144e242a9b219c5570973ca26d03e82e9fbe7ba2773305d1713288ae3540b4ad"
        hash = "8db86ad90883cd208cf86acd45e67c03f994998804441705d690cb6526614d00"

        id = "b2f1d8d0-8668-5641-8ce9-c8dd71f51f58"
    strings:
        $backtick = /`\s*\{?\$(_POST\[|_GET\[|_REQUEST\[|_SERVER\['HTTP_)/ wide ascii

        //strings from private rule capa_php_old_safe
        $php_short = "<?" wide ascii
        // prevent xml and asp from hitting with the short tag
        $no_xml1 = "<?xml version" nocase wide ascii
        $no_xml2 = "<?xml-stylesheet" nocase wide ascii
        $no_asp1 = "<%@LANGUAGE" nocase wide ascii
        $no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
        $no_pdf = "<?xpacket"

        // of course the new tags should also match
        // already matched by "<?"
        $php_new1 = /<\?=[^?]/ wide ascii
        $php_new2 = "<?php" nocase wide ascii
        $php_new3 = "<script language=\"php" nocase wide ascii

    condition:
        (
            (
                (
                        $php_short in (0..100) or
                        $php_short in (filesize-1000..filesize)
                )
                and not any of ( $no_* )
            )
            or any of ( $php_new* )
        )
        and $backtick and filesize < 200
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 10 string patterns in its detection logic.

References

• Internal Research
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the “Generic PHP webshell using backticks on user input” detection rule, along with recommended filters:

• Scenario: Automated Log Analysis via Cron Jobs

  • Context: A nightly maintenance script running via cron executes a PHP utility that parses server logs. The script accepts log file paths as command-line arguments (user input) and uses backticks to execute shell commands for grep or awk processing within the PHP logic.
  • Filter/Exclusion: Exclude alerts where the source process is the system cron daemon (crond) or a specific scheduled job ID, running on a known maintenance window (e.g., 02:00–04:00 UTC).
    • Example Filter: Source_Process_Name IN ['cron', 'systemd-timer'] AND Execution_Time BETWEEN '02:00' AND '04:00'

• Scenario: CI/CD Pipeline Artifact Generation

  • Context: The DevOps team utilizes Jenkins or GitLab Runners to deploy applications. During the build phase, a PHP deployment agent accepts repository branch names and commit hashes as input variables. It uses backticks to dynamically generate Docker image tags or execute git commands based on these inputs.
  • Filter/Exclusion: Create an exclusion for traffic originating from known CI/CD runner IP ranges (e.g., the private subnet of the Jenkins controller) where the user agent string contains “Jenkins” or “GitLab-Runner”.
    • Example Filter: Source_IP IN ['10.20.30.0/24'] AND User_Agent CONTAINS 'Jenkins'

• Scenario: Admin Dashboard Reporting Module

  • Context: The internal IT portal features a “System Health” dashboard where administrators can input custom date