Detection rules
Reference pages for the Panomity YARA rule sets, the hash sets and the heuristics engine that Shelltrap findings link to.
Every finding names the rule that produced it. These pages explain what each rule set looks for, how scores are assigned and how to report a false positive.
- PHP obfuscation rules — 11 rules
- Known webshell families — 8 rules
- PHP remote code execution patterns — 6 rules
- WordPress-specific droppers — 5 rules
- Hash sets
- Heuristics engine
Think a finding is wrong? Reporting a false positive is an automated procedure: finding ID, rule name, SHA-256 and the file itself to falsepositive@shelltrap.com from your registered client-area address, with an answer usually inside an hour and an allowlist entry in the next signed generation.