Heuristics engine
How Shelltrap’s built-in heuristics score PHP and script files without signatures: signal groups, weak signals, allowlists and how to tune false positives per domain.
The heuristics engine (shelltrap:heuristics-v1, proprietary, Panomity GmbH) scores files by combining independent signals: request-driven command execution, dynamic eval/assert, encoded payload layers, escape density, entropy and long lines.
- Weak statistical signals (entropy, long lines) never produce a suspicious verdict on their own; minified bundles and caches stay clean.
- Documented library files (PHP tag first, a
@package/@licensedocblock in the first 2 KiB, no eval/base64_decode/gzinflate) are held below suspicious even with escape-heavy code. - Verified WordPress core files are cleared by the allow sets before heuristics run.
- Per domain,
heuristics.actioncan be set to report, quarantine or off, andheuristics.thresholdraises the bar for suspicious findings.
Reporting a false positive
Send the finding ID, the rule name, the SHA-256 and the file itself to falsepositive@shelltrap.com , from the email address registered in your client area . The file is re-scanned and analysed automatically on our own hardware in Munich, and the answer usually arrives within an hour from sentinel@shelltrap.com . A confirmed false positive is allowlisted by SHA-256 in the next signed generation, published immediately; the heuristic itself is adjusted in a later generation. The full procedure .