PHP Webshell Detection - Gated Eval and Base64 Obfuscation
This rule detects PHP webshell patterns. The first rule, 'PHP_Webshell_GatedEval_GETaaaa_POST1', identifies webshells that use a specific GET parameter 'aaaa' and a POST parameter '1' in conjunction with an 'eval' function to execute code. The second rule, 'PHP_Webshell_ASS_Base64_Eval_DQo_Delimiters', looks for webshells that utilize 'base64_decode' and 'eval' functions, often with a distinctive 'DQo=' delimiter, and receive input from at least two common web input sources like $_COOKIE, $_GET, or $_POST, along with the string 'ASS'.
YARA
