PHP webshell obfuscated by encoding of mixed hex and dec

Hunt Hypothesis

This detection identifies adversaries who deploy PHP webshells that evade signature-based defenses by obfuscating malicious payloads through a combination of hexadecimal and decimal encoding techniques. Proactively hunting for this behavior in Azure Sentinel is critical to uncover stealthy post-exploitation footholds that might otherwise bypass standard web traffic analysis due to their complex, mixed-encoding structure.

YARA Rule

rule WEBSHELL_PHP_OBFUSC_Encoded_Mixed_Dec_And_Hex
{
    meta:
        description = "PHP webshell obfuscated by encoding of mixed hex and dec"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        reference = "Internal Research"
        score = 75
        date = "2021/04/18"
        modified = "2023-04-05"
        hash = "0e21931b16f30b1db90a27eafabccc91abd757fa63594ba8a6ad3f477de1ab1c"
        hash = "929975272f0f42bf76469ed89ebf37efcbd91c6f8dac1129c7ab061e2564dd06"
        hash = "88fce6c1b589d600b4295528d3fcac161b581f739095b99cd6c768b7e16e89ff"
        hash = "883f48ed4e9646da078cabf6b8b4946d9f199660262502650f76450ecf60ddd5"
        hash = "50389c3b95a9de00220fc554258fda1fef01c62dad849e66c8a92fc749523457"
        hash = "c4ab4319a77b751a45391aa01cde2d765b095b0e3f6a92b0b8626d5c7e3ad603"
        hash = "df381f04fca2522e2ecba0f5de3f73a655d1540e1cf865970f5fa3bf52d2b297"
        hash = "401388d8b97649672d101bf55694dd175375214386253d0b4b8d8d801a89549c"
        hash = "99fc39a12856cc1a42bb7f90ffc9fe0a5339838b54a63e8f00aa98961c900618"
        hash = "fb031af7aa459ee88a9ca44013a76f6278ad5846aa20e5add4aeb5fab058d0ee"
        hash = "dd5d8a9b4bb406e0b8f868165a1714fe54ffb18e621582210f96f6e5ae850b33"
        hash = "0ff05e6695074f98b0dee6200697a997c509a652f746d2c1c92c0b0a0552ca47"

        id = "9ae920e2-17c8-58fd-8566-90d461a54943"
    strings:
        // "e\x4a\x48\x5a\x70\x63\62\154\x30\131\171\101\x39\111\x43\x52\x66\x51\
        //$mix = /['"]\\x?[0-9a-f]{2,3}[\\\w]{2,20}\\\d{1,3}[\\\w]{2,20}\\x[0-9a-f]{2}\\/ wide ascii nocase
        $mix = /['"](\w|\\x?[0-9a-f]{2,3})[\\x0-9a-f]{2,20}\\\d{1,3}[\\x0-9a-f]{2,20}\\x[0-9a-f]{2}\\/ wide ascii nocase

        //strings from private rule capa_php_old_safe
        $php_short = "<?" wide ascii
        // prevent xml and asp from hitting with the short tag
        $no_xml1 = "<?xml version" nocase wide ascii
        $no_xml2 = "<?xml-stylesheet" nocase wide ascii
        $no_asp1 = "<%@LANGUAGE" nocase wide ascii
        $no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
        $no_pdf = "<?xpacket"

        // of course the new tags should also match
        // already matched by "<?"
        $php_new1 = /<\?=[^?]/ wide ascii
        $php_new2 = "<?php" nocase wide ascii
        $php_new3 = "<script language=\"php" nocase wide ascii

    condition:
        filesize < 700KB and (
            (
                (
                        $php_short in (0..100) or
                        $php_short in (filesize-1000..filesize)
                )
                and not any of ( $no_* )
            )
            or any of ( $php_new* )
        )
        and any of ( $mix* )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 11 string patterns in its detection logic.

References

• Internal Research
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the PHP webshell obfuscated by encoding of mixed hex and dec rule, along with recommended filters or exclusions:

• Scenario: Automated Backup Scripts Using base64_decode and Custom Hex Logic

  • Context: Enterprise backup agents (e.g., Veeam, Commvault) often run PHP scripts that package configuration data. These scripts frequently mix standard Base64 strings with custom hex-decimal conversion logic to compress logs before transmission. The mixed encoding pattern mimics the obfuscation signature of a webshell.
  • Filter/Exclusion: Exclude traffic where the source user agent contains Veeam or Commvault, and the destination URL path matches /api/backup/config. Alternatively, filter out requests where the HTTP method is POST and the Content-Type header is application/json rather than a raw PHP execution context.

• Scenario: CI/CD Pipeline Deployment Artifacts (Jenkins/GitLab)

  • Context: During deployment cycles, tools like Jenkins or GitLab CI execute PHP-based deployment agents that inject configuration manifests into the web server. These agents often use mixed hex and decimal encoding to hash checksums of deployed artifacts within a single request payload to verify integrity before activation.
  • Filter/Exclusion: Create an exclusion for traffic originating from known CI/CD IP ranges (e.g., internal Jenkins subnet) where the request URI contains /deploy or /artifact. Additionally, filter out events occurring during scheduled maintenance windows defined in the calendar system.

• Scenario: Legacy CRM Data Migration Jobs

  • Context: Scheduled nightly jobs for legacy Customer Relationship Management systems (e.g., Salesforce custom connectors or SAP NetWeaver) utilize PHP scripts to migrate large datasets. To handle special characters and binary data, these scripts employ a hybrid encoding scheme mixing hex representations of