

Matched rule: webshell_p hp_obfusca ted date = 2, author = Arnim Ru pp, descri ption = PH P webshell obfuscate d, license = Detecti on Rule Li cense 1.1 /N eo23x0/sig nature-bas e/blob/mas ter/LICENS E, hash = eec9ac58a1 e763f5ea0f 7fa249f1fe 752047fa60 Matched rule: webshell_p hp_generic _eval date = 2021/01 /07, autho r = Arnim Rupp, desc ription = Generic PH P webshell which use s any eval /exec func tion in th e same lin e with use r input, l icense = D etection R ule Licens e 1.1 http s://github. Yara signature match Source: tablerst.c ss.php, ty pe: SAMPLE PHP webshell obfuscated by encoding of mixed hex and dec

Webshell_php_obfuscated_encoding_mixed_dec_and_hex Generic PHP webshell which uses any eval/exec function in the same line with user input Execute Shell Command (safe mode is off):
