← All detection heuristics · Webshell
critical
WEBSHELL_PHP
What it means
The file contains PHP code with the signature of a webshell/backdoor (request input fed to a command/code-exec sink, or a named-shell banner).
Why it fires
A webshell takes attacker input from an HTTP request and runs commands or code on the server (RCE). It is flagged as a malicious hacktool artifact even when carried inside a document or archive (e.g. a c99/Locus7s PHP shell pasted into an RTF) — the code does not run from the carrier, but the file IS a webshell. Detection requires a multi-token combination (script tag + request input + exec sink, a decoder/second sink, or a distinctive named-shell banner) so ordinary server code does not false-positive.