obfuscated php webshell

Hunt Hypothesis

This detection identifies adversaries who deploy obfuscated PHP webshells to establish persistent access and execute commands within web-facing applications. Proactive hunting for this behavior in Azure Sentinel is critical because obfuscation techniques often evade standard signature-based defenses, requiring deep inspection of file integrity and runtime execution patterns to uncover hidden backdoors before they are leveraged for lateral movement or data exfiltration.

YARA Rule

rule WEBSHELL_PHP_Unknown_1
{
    meta:
        description = "obfuscated php webshell"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        reference = "Internal Research"
        score = 75
        hash = "12ce6c7167b33cc4e8bdec29fb1cfc44ac9487d1"
        hash = "cf4abbd568ce0c0dfce1f2e4af669ad2"
        date = "2021/01/07"
        modified = "2023-04-05"

        id = "93d01a4c-4c18-55d2-b682-68a1f6460889"
    strings:
        $sp0 = /^<\?php \$[a-z]{3,30} = '/ wide ascii
        $sp1 = "=explode(chr(" wide ascii
        $sp2 = "; if (!function_exists('" wide ascii
        $sp3 = " = NULL; for(" wide ascii

    condition:
        filesize <300KB and all of ($sp*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

• Internal Research
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Obfuscated PHP Webshell detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Legitimate CMS Plugin Updates via Admin Panel

  • Context: Administrators using WordPress or Drupal often install new plugins or themes that contain heavily obfuscated PHP code (minified strings, base64 encoding) to reduce file size. The detection logic may flag these legitimate plugin uploads as malicious webshells due to the high entropy of the code.
  • Suggested Filter/Exclusion: Create an exclusion rule based on the source IP range of the internal Admin Workstations (e.g., 10.20.50.0/24) and restrict alerts to files uploaded outside of standard business hours or by non-admin user accounts. Additionally, whitelist specific file paths known for hosting plugins, such as /wp-content/plugins/* or /sites/all/modules/*.

• Scenario: Scheduled Backup Scripts with Base64 Payloads

  • Context: Enterprise backup solutions (e.g., Veeam, Acronis) often utilize custom PHP scripts to generate reports or trigger backups. These scripts frequently embed configuration data or logs in Base64-encoded strings within the PHP file, which mimics the obfuscation techniques used by webshells like RCE (Remote Code Execution) loaders.
  • Suggested Filter/Exclusion: Implement a time-based exclusion for known scheduled jobs. If the alert occurs during the defined maintenance window (e.g., 02:00–04:00 UTC) and the file path matches the backup directory pattern (e.g., /var/www/backups/scripts/*), suppress the alert. Alternatively, exclude files where the User-Agent header in the HTTP request contains specific identifiers like “Veeam-Backup-Agent”.