PHP remote code execution patterns

Direct command execution driven by request data: system/exec/passthru/shell_exec with superglobals, backtick execution, proc_open pipes and similar.

Source file: panomity_php_rce.yar (license MIT, author Panomity GmbH). Scores range from 0 to 100; 85 and above marks a finding as malicious on its own, 40 to 84 as suspicious.

Rule	Score	What it detects
`Panomity_PHP_Superglobal_Command_Exec`	90	OS command function fed directly from request input, including whitespace-padded variants
`Panomity_PHP_Superglobal_Eval`	90	eval() executed directly on request input
`Panomity_PHP_Backticks_Superglobal`	88	Shell backtick execution of request input inside a PHP file
`Panomity_PHP_Base64_Superglobal_Exec`	87	Command/eval sink taking base64_decode() of request input
`Panomity_PHP_Image_Polyglot_PHP_Payload`	90	Image file (JPEG/PNG/GIF/ICO magic) carrying an executable PHP payload appended to the pixels
`Panomity_PHP_Preg_Replace_Superglobal`	86	preg_replace() whose subject or replacement is request input combined with the /e modifier

Reporting a false positive

Send the finding ID, the rule name, the SHA-256 and the file itself to falsepositive@shelltrap.com , from the email address registered in your client area . Mail from another address is not processed, and without the file there is no automatic review.

The file is re-scanned against the current generation and analysed automatically on Panomity’s own hardware in Munich; it is never executed and never passed to a third party. The answer usually arrives within an hour from sentinel@shelltrap.com . A confirmed false positive is allowlisted by SHA-256 in the next signed generation, which is published immediately and reaches every server at its next feed refresh; the rule itself is tightened in a later generation. ClamAV and hash-set hits are never released automatically, and unclear or rejected cases go to a human through a ticket in the client area.

The full procedure .