← Back to SOC feed Coverage →

Web Shell - file PHPJackal v1.5.php

yara HIGH signature-base
florian-rothwebshell
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at signature-base →
Retrieved: 2026-08-10T11:00:00Z · Confidence: medium

Hunt Hypothesis

This detection identifies the creation of a specific web shell artifact (PHPJackal v1.5.php) that adversaries deploy to establish persistent remote access and execute commands on compromised web servers. Proactive hunting for this signature in Azure Sentinel is critical because web shells often serve as the initial foothold for post-exploitation activities, enabling attackers to move laterally and exfiltrate sensitive data before broader detection mechanisms trigger.

YARA Rule

rule webshell_PHPJackal_v1_5 {
	meta:
		description = "Web Shell - file PHPJackal v1.5.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "d76dc20a4017191216a0315b7286056f"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s7 = "echo \"<center>${t}MySQL cilent:</td><td bgcolor=\\\"#333333\\\"></td></tr><form"
		$s8 = "echo \"<center>${t}Wordlist generator:</td><td bgcolor=\\\"#333333\\\"></td></tr"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 2 string patterns in its detection logic.

False Positive Guidance

Here are 4 specific false positive scenarios for the Web Shell - file PHPJackal v1.5.php detection rule, along with recommended filters and exclusions:

Original source: https://github.com/Neo23x0/signature-base/blob/main/yara/thor-webshells.yar