PHP obfuscation rules
Loader and obfuscation patterns: eval/base64 chains, assert and create_function loaders, preg_replace /e, str_rot13/gzinflate layers, hex and chr escapes, variable functions and packed payloads.
Loader and obfuscation patterns: eval/base64 chains, assert and create_function loaders, preg_replace /e, str_rot13/gzinflate layers, hex and chr escape chains, goto obfuscation.
Source file: panomity_php_obfuscation.yar (license MIT, author Panomity GmbH). Scores range from 0 to 100; 85 and above marks a finding as malicious on its own, 40 to 84 as suspicious.
| Rule | Score | What it detects |
|---|---|---|
Panomity_PHP_Eval_Base64_Chain | 90 | eval() applied directly to a decode/inflate call, the classic packed PHP shell loader |
Panomity_PHP_Assert_Superglobal_Loader | 90 | assert() used as a code-execution sink over request input |
Panomity_PHP_Assert_Decode_Loader | 88 | assert() applied to a decode/inflate call used as an eval substitute |
Panomity_PHP_CreateFunction_Loader | 87 | create_function() lambda body built from request input or a decode call |
Panomity_PHP_PregReplace_E_Modifier | 88 | preg_replace() with the deprecated /e modifier, a code-execution primitive in old PHP shells |
Panomity_PHP_StrRot13_GzInflate | 90 | Stacked str_rot13/gzinflate/base64 decode layers wrapping an executable payload |
Panomity_PHP_Hex_Escape_Chain | 85 | PHP file whose executable identifiers are hidden as long \x hex escape runs |
Panomity_PHP_Chr_Concat_Chain | 85 | PHP identifier assembled from a long chr() concatenation chain |
Panomity_PHP_Goto_Obfuscation | 85 | PHP file flattened with many goto jumps to random labels, typical of automated shell packers |
Panomity_PHP_Concat_Eval_Obfuscation | 86 | eval/assert identifier split across string concatenation to evade naive scanners |
Panomity_PHP_Variable_Function_Superglobal | 89 | Variable-function dispatch where both callable and argument come from request input |
Reporting a false positive
Send the finding ID, the rule name, the SHA-256 and the file itself to falsepositive@shelltrap.com , from the email address registered in your client area . Mail from another address is not processed, and without the file there is no automatic review.
The file is re-scanned against the current generation and analysed automatically on Panomity’s own hardware in Munich; it is never executed and never passed to a third party. The answer usually arrives within an hour from sentinel@shelltrap.com . A confirmed false positive is allowlisted by SHA-256 in the next signed generation, which is published immediately and reaches every server at its next feed refresh; the rule itself is tightened in a later generation. ClamAV and hash-set hits are never released automatically, and unclear or rejected cases go to a human through a ticket in the client area.