Detection rules on Shelltrap

Hash sets

Fri, 04 Sep 2026 12:00:00 +0200

Shelltrap ships two kinds of hash data in every signed generation:

Known-bad hashes (hashes/*.hsb): exact SHA-256 matches of confirmed malware. A match produces a malicious verdict with confidence 100.
Allow sets (allow/*.sha256): SHA-256 hashes of verified files, currently the WordPress core files of supported releases downloaded from wordpress.org and hashed by Panomity. A match suppresses heuristic signals for that file; signature and ClamAV hits still take precedence.

Hashes are data, not works; the allow sets are published under the MIT license by Panomity GmbH. False positives or missing versions: hallo@panomity.de .

Heuristics engine

Fri, 04 Sep 2026 12:00:00 +0200

The heuristics engine (shelltrap:heuristics-v1, proprietary, Panomity GmbH) scores files by combining independent signals: request-driven command execution, dynamic eval/assert, encoded payload layers, escape density, entropy and long lines.

Weak statistical signals (entropy, long lines) never produce a suspicious verdict on their own; minified bundles and caches stay clean.
Documented library files (PHP tag first, a @package/@license docblock in the first 2 KiB, no eval/base64_decode/gzinflate) are held below suspicious even with escape-heavy code.
Verified WordPress core files are cleared by the allow sets before heuristics run.
Per domain, heuristics.action can be set to report, quarantine or off, and heuristics.threshold raises the bar for suspicious findings.

Report false positives with finding ID and file hash to hallo@panomity.de .

Known webshell families

Fri, 04 Sep 2026 12:00:00 +0200

Signature strings of well-known PHP webshells (c99, r57, b374k, WSO, FilesMan, p0wny), spam mailers and back-connect helpers. Every rule requires PHP context and at least two independent indicators.

Source file: panomity_known_shells.yar (license MIT, author Panomity GmbH). Scores range from 0 to 100; 85 and above marks a finding as malicious on its own, 40 to 84 as suspicious.

Rule	Score	What it detects
`Panomity_Shell_C99`	92	c99 PHP webshell family markers
`Panomity_Shell_R57`	92	r57 PHP webshell family markers
`Panomity_Shell_B374k`	92	b374k PHP webshell family markers
`Panomity_Shell_WSO`	90	WSO (Web Shell by oRb) family markers
`Panomity_Shell_FilesMan`	88	FilesMan file-manager webshell module marker
`Panomity_Shell_P0wny`	92	p0wny-shell single-file PHP shell markers
`Panomity_Shell_Generic_Mailer_Spam`	86	Bulk mailer spam kit markers (leaf/inbox mailer style), distinct from legitimate mail libraries
`Panomity_Shell_Generic_Uname_Backconnect`	87	Generic PHP shell exposing a back-connect helper driven by request input

Reporting a false positive

Send the finding ID, the rule name and, if possible, the file (or its SHA-256) to hallo@panomity.de or open a ticket in the client area . Confirmed false positives are fixed in the next signed generation; clients receive it automatically.

PHP obfuscation rules

Fri, 04 Sep 2026 12:00:00 +0200

Loader and obfuscation patterns: eval/base64 chains, assert and create_function loaders, preg_replace /e, str_rot13/gzinflate layers, hex and chr escape chains, goto obfuscation.

Source file: panomity_php_obfuscation.yar (license MIT, author Panomity GmbH). Scores range from 0 to 100; 85 and above marks a finding as malicious on its own, 40 to 84 as suspicious.

Rule	Score	What it detects
`Panomity_PHP_Eval_Base64_Chain`	90	eval() applied directly to a decode/inflate call, the classic packed PHP shell loader
`Panomity_PHP_Assert_Superglobal_Loader`	90	assert() used as a code-execution sink over request input
`Panomity_PHP_Assert_Decode_Loader`	88	assert() applied to a decode/inflate call used as an eval substitute
`Panomity_PHP_CreateFunction_Loader`	87	create_function() lambda body built from request input or a decode call
`Panomity_PHP_PregReplace_E_Modifier`	88	preg_replace() with the deprecated /e modifier, a code-execution primitive in old PHP shells
`Panomity_PHP_StrRot13_GzInflate`	90	Stacked str_rot13/gzinflate/base64 decode layers wrapping an executable payload
`Panomity_PHP_Hex_Escape_Chain`	85	PHP file whose executable identifiers are hidden as long \x hex escape runs
`Panomity_PHP_Chr_Concat_Chain`	85	PHP identifier assembled from a long chr() concatenation chain
`Panomity_PHP_Goto_Obfuscation`	85	PHP file flattened with many goto jumps to random labels, typical of automated shell packers
`Panomity_PHP_Concat_Eval_Obfuscation`	86	eval/assert identifier split across string concatenation to evade naive scanners
`Panomity_PHP_Variable_Function_Superglobal`	89	Variable-function dispatch where both callable and argument come from request input

Reporting a false positive

PHP remote code execution patterns

Fri, 04 Sep 2026 12:00:00 +0200

Direct command execution driven by request data: system/exec/passthru/shell_exec with superglobals, backtick execution, proc_open pipes and similar.

Source file: panomity_php_rce.yar (license MIT, author Panomity GmbH). Scores range from 0 to 100; 85 and above marks a finding as malicious on its own, 40 to 84 as suspicious.

Rule	Score	What it detects
`Panomity_PHP_Superglobal_Command_Exec`	90	OS command function fed directly from request input, including whitespace-padded variants
`Panomity_PHP_Superglobal_Eval`	90	eval() executed directly on request input
`Panomity_PHP_Backticks_Superglobal`	88	Shell backtick execution of request input inside a PHP file
`Panomity_PHP_Base64_Superglobal_Exec`	87	Command/eval sink taking base64_decode() of request input
`Panomity_PHP_Image_Polyglot_PHP_Payload`	90	Image file (JPEG/PNG/GIF/ICO magic) carrying an executable PHP payload appended to the pixels
`Panomity_PHP_Preg_Replace_Superglobal`	86	preg_replace() whose subject or replacement is request input combined with the /e modifier

Reporting a false positive

WordPress-specific droppers

Fri, 04 Sep 2026 12:00:00 +0200

Backdoors that hide inside WordPress structures: PHP in uploads, fake wp-config includes, mu-plugins backdoors, fake plugin headers with curl/eval, appended eval in index.php.

Source file: panomity_wordpress_droppers.yar (license MIT, author Panomity GmbH). Scores range from 0 to 100; 85 and above marks a finding as malicious on its own, 40 to 84 as suspicious.

Rule	Score	What it detects
`Panomity_WP_Uploads_PHP_Dropper`	88	PHP file dropped into wp-content/uploads that writes another PHP payload
`Panomity_WP_Config_Fake_Include`	87	Fake wp-config style loader that includes and evaluates a hidden payload file
`Panomity_WP_MuPlugins_Backdoor`	90	mu-plugins auto-loaded backdoor combining add_action with dynamic code execution on request input
`Panomity_WP_Fake_Plugin_Header_Backdoor`	89	File carrying a WordPress plugin header while fetching and evaluating remote code
`Panomity_WP_Index_Appended_Eval`	86	WordPress bootstrap file with an appended eval loader over request input