PHP obfuscation rules

Loader and obfuscation patterns: eval/base64 chains, assert and create_function loaders, preg_replace /e, str_rot13/gzinflate layers, hex and chr escape chains, goto obfuscation.

Source file: panomity_php_obfuscation.yar (license MIT, author Panomity GmbH). Scores range from 0 to 100; 85 and above marks a finding as malicious on its own, 40 to 84 as suspicious.

Rule	Score	What it detects
`Panomity_PHP_Eval_Base64_Chain`	90	eval() applied directly to a decode/inflate call, the classic packed PHP shell loader
`Panomity_PHP_Assert_Superglobal_Loader`	90	assert() used as a code-execution sink over request input
`Panomity_PHP_Assert_Decode_Loader`	88	assert() applied to a decode/inflate call used as an eval substitute
`Panomity_PHP_CreateFunction_Loader`	87	create_function() lambda body built from request input or a decode call
`Panomity_PHP_PregReplace_E_Modifier`	88	preg_replace() with the deprecated /e modifier, a code-execution primitive in old PHP shells
`Panomity_PHP_StrRot13_GzInflate`	90	Stacked str_rot13/gzinflate/base64 decode layers wrapping an executable payload
`Panomity_PHP_Hex_Escape_Chain`	85	PHP file whose executable identifiers are hidden as long \x hex escape runs
`Panomity_PHP_Chr_Concat_Chain`	85	PHP identifier assembled from a long chr() concatenation chain
`Panomity_PHP_Goto_Obfuscation`	85	PHP file flattened with many goto jumps to random labels, typical of automated shell packers
`Panomity_PHP_Concat_Eval_Obfuscation`	86	eval/assert identifier split across string concatenation to evade naive scanners
`Panomity_PHP_Variable_Function_Superglobal`	89	Variable-function dispatch where both callable and argument come from request input

Reporting a false positive

Send the finding ID, the rule name and, if possible, the file (or its SHA-256) to hallo@panomity.de or open a ticket in the client area . Confirmed false positives are fixed in the next signed generation; clients receive it automatically.