Weevely Webshell - Generic Rule - heavily scrambled tiny web shell

Hunt Hypothesis

This detection targets adversaries deploying a highly obfuscated and compact Weevely webshell to establish persistent access points within web applications for command execution and data exfiltration. A proactive hunt is essential in Azure Sentinel because these tiny, scrambled artifacts often evade standard signature-based defenses, requiring behavioral analysis to uncover stealthy post-compromise activities before they escalate into significant breaches.

YARA Rule

rule Weevely_Webshell {
	meta:
		description = "Weevely Webshell - Generic Rule - heavily scrambled tiny web shell"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.ehacking.net/2014/12/weevely-php-stealth-web-backdoor-kali.html"
		date = "2014/12/14"
		score = 60
		id = "12aa177a-4ebc-5ed8-a81b-34ec83395ec4"
	strings:
		$s0 = /\$[a-z]{4} = \$[a-z]{4}\("[a-z][a-z]?",[\s]?"",[\s]?"/ ascii
		$s1 = /\$[a-z]{4} = str_replace\("[a-z][a-z]?","","/ ascii
		$s2 = /\$[a-z]{4}\.\$[a-z]{4}\.\$[a-z]{4}\.\$[a-z]{4}\)\)\); \$[a-z]{4}\(\);/ ascii
		$s4 = /\$[a-z]{4}="[a-zA-Z0-9]{70}/ ascii
	condition:
		uint32(0) == 0x68703f3c and all of ($s*) and filesize > 570 and filesize < 800
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

• http://www.ehacking.net/2014/12/weevely-php-stealth-web-backdoor-kali.html
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Weevely Webshell - Generic Rule in an enterprise environment, including suggested filters and exclusions:

• Scenario: Automated Backup Script Execution via PowerShell

  • Context: Enterprise backup solutions (e.g., Veeam or Commvault) often execute PowerShell scripts that invoke System.Reflection to dynamically load assemblies for reporting. These scripts frequently generate highly compressed, obfuscated payloads that resemble the “heavily scrambled” signature of a Weevely webshell.
  • Filter/Exclusion: Create an exclusion rule based on the Process Name (powershell.exe) and Command Line. Filter out alerts where the command line contains specific backup keywords (e.g., Veeam.Backup, CommvaultAgent) or originates from a known service account (e.g., DOMAIN\svc_backup).

• Scenario: CI/CD Pipeline Artifact Deployment

  • Context: During automated deployment cycles, tools like Jenkins or Azure DevOps Agents upload compressed artifacts to the web server. The agent often uses a generic HTTP client library that sends requests with high entropy in the body (due to GZIP compression of large JSON manifests), triggering the “tiny web shell” heuristic which expects low-entropy content for standard web traffic.
  • Filter/Exclusion: Exclude alerts where the Source IP belongs to the internal CI/CD subnet range and the User-Agent string matches known pipeline agents (e.g., Jenkins/2.x, AzureDevOpsAgent). Additionally, filter by time-of-day if deployments are restricted to maintenance windows.

• Scenario: Application Server Health Checks with Obfuscated Payloads

  • Context: Load balancers (such as F5 or NGINX) and monitoring tools (like Datadog Agent or SolarWinds) perform frequent health checks against