PHP remote code execution patterns

Direct command execution driven by request data: system/exec/passthru/shell_exec with superglobals, backtick execution, proc_open pipes and similar.

Source file: panomity_php_rce.yar (license MIT, author Panomity GmbH). Scores range from 0 to 100; 85 and above marks a finding as malicious on its own, 40 to 84 as suspicious.

Rule	Score	What it detects
`Panomity_PHP_Superglobal_Command_Exec`	90	OS command function fed directly from request input, including whitespace-padded variants
`Panomity_PHP_Superglobal_Eval`	90	eval() executed directly on request input
`Panomity_PHP_Backticks_Superglobal`	88	Shell backtick execution of request input inside a PHP file
`Panomity_PHP_Base64_Superglobal_Exec`	87	Command/eval sink taking base64_decode() of request input
`Panomity_PHP_Image_Polyglot_PHP_Payload`	90	Image file (JPEG/PNG/GIF/ICO magic) carrying an executable PHP payload appended to the pixels
`Panomity_PHP_Preg_Replace_Superglobal`	86	preg_replace() whose subject or replacement is request input combined with the /e modifier

Reporting a false positive

Send the finding ID, the rule name and, if possible, the file (or its SHA-256) to hallo@panomity.de or open a ticket in the client area . Confirmed false positives are fixed in the next signed generation; clients receive it automatically.