PHP webshell which eval()s another included file

Hunt Hypothesis

This detection identifies a sophisticated PHP webshell attack where an adversary leverages the eval() function to dynamically execute code from an externally included file, often indicating post-exploitation command execution or lateral movement capabilities. The SOC team should proactively hunt for this behavior in Azure Sentinel because such dynamic evaluation patterns are frequently used by attackers to establish persistent backdoors that can evade static signature-based detection while executing malicious payloads on compromised web servers.

YARA Rule

rule WEBSHELL_PHP_Includer_Eval
{
    meta:
        description = "PHP webshell which eval()s another included file"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        reference = "Internal Research"
        score = 75
        date = "2021/01/13"
        modified = "2023-04-05"
        hash = "3a07e9188028efa32872ba5b6e5363920a6b2489"
        hash = "ab771bb715710892b9513b1d075b4e2c0931afb6"
        hash = "202dbcdc2896873631e1a0448098c820c82bcc8385a9f7579a0dc9702d76f580"
        hash = "b51a6d208ec3a44a67cce16dcc1e93cdb06fe150acf16222815333ddf52d4db8"

        id = "995fcc34-f91e-5c9c-97b1-84eed1714d40"
    strings:
        $payload1 = "eval" fullword wide ascii
        $payload2 = "assert" fullword wide ascii
        $include1 = "$_FILE" wide ascii
        $include2 = "include" wide ascii

        //strings from private rule capa_php_old_safe
        $php_short = "<?" wide ascii
        // prevent xml and asp from hitting with the short tag
        $no_xml1 = "<?xml version" nocase wide ascii
        $no_xml2 = "<?xml-stylesheet" nocase wide ascii
        $no_asp1 = "<%@LANGUAGE" nocase wide ascii
        $no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
        $no_pdf = "<?xpacket"

        // of course the new tags should also match
        // already matched by "<?"
        $php_new1 = /<\?=[^?]/ wide ascii
        $php_new2 = "<?php" nocase wide ascii
        $php_new3 = "<script language=\"php" nocase wide ascii

    condition:
        filesize < 200 and (
            (
                (
                        $php_short in (0..100) or
                        $php_short in (filesize-1000..filesize)
                )
                and not any of ( $no_* )
            )
            or any of ( $php_new* )
        )
        and 1 of ( $payload* ) and 1 of ( $include* )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 13 string patterns in its detection logic.

References

• Internal Research
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the PHP webshell which eval()s another included file detection rule, along with suggested filters or exclusions:

• Scenario: Automated Backup and Reporting Scripts

  • Context: Enterprise backup solutions like Veeam or custom internal reporting tools often utilize PHP scripts that dynamically include configuration files (e.g., config.php) and use eval() to execute report generation logic based on runtime variables. These scripts are typically located in a dedicated /var/www/backup directory rather than the public web root.
  • Filter/Exclusion: Exclude file paths matching */backup/* or specific script names like generate_daily_report.php. Additionally, filter out events where the user context is a service account (e.g., www-data or vps-backup) rather than an interactive admin session.

• Scenario: CMS Plugin Updates via Control Panel

  • Context: Content Management Systems like WordPress, Drupal, or Joomla frequently trigger this rule during plugin updates or theme customizations. The core update mechanism often loads a temporary PHP file, includes the new module definition, and uses eval() to process dependencies before committing changes. This is common when using tools like Jetpack or Advanced Custom Fields.
  • Filter/Exclusion: Create an exclusion for known CMS plugin directories (e.g., /wp-content/plugins/*, /modules/custom/*). Furthermore, filter events where the HTTP User-Agent string contains keywords indicating a management tool, such as “WordPress Updater,” “WP-CLI,” or “Cron Job.”

• Scenario: Scheduled Cron Jobs for Data Synchronization

  • Context: Scheduled jobs running via cron often execute PHP scripts to sync data between the web server and an internal ERP (e.g., SAP, **Salesforce