Webshell heuristics

4 detection rules

← All detection heuristics

PHP webshell / backdoor source critical WEBSHELL_PHP
The file contains PHP code with the signature of a webshell/backdoor (request input fed to a command/code-exec sink, or a named-shell banner).
ASP webshell / backdoor source high WEBSHELL_ASP
The file contains ASP webshell code (eval/Execute over Request input, or WScript.Shell.Run of request data).
JSP webshell / backdoor source high WEBSHELL_JSP
The file contains JSP webshell code (Runtime.exec / ProcessBuilder driven by a request parameter).
Known webshell marker string medium WEBSHELL_MARKER
A distinctive named-webshell marker (c99shell/r57/WSO/b374k/Locus7s/…) was found without surrounding script context.