<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-webshell-artifacts
description: >-
  Detect, analyze, and attribute webshell artifacts across PHP, ASP, JSP, and
  Python server-side environments using pattern matching, YARA rules, and
  behavioral analysis techniques.
domain: cybersecurity
subdomain: malware-analysis
tags:
  - webshell
  - php
  - asp
  - jsp
  - web-exploitation
  - persistence
  - malware-analysis
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1505.003"]
---

# Analyzing Webshell Artifacts

## Overview

Webshells are server-side scripts that provide remote access and command execution on compromised web servers. They range from simple one-line PHP backdoors (`<?php eval($_POST['cmd']); ?>`) to sophisticated multi-feature panels with file management, database access, and lateral movement capabilities. Analysis involves identifying obfuscation techniques, extracting authentication mechanisms, mapping capabilities, and attributing the shell to known families or threat actors.

## Prerequisites

- YARA with webshell rule sets (Neo23x0/signature-base)
- PHP/ASP/JSP deobfuscation tools
- `php -r` for safe eval-replacement analysis
- Apache/IIS/Nginx log access for behavioral analysis
- NeoPI or BackdoorMan for entropy-based webshell detection
- REMnux or isolated web server for dynamic analysis

## Key Concepts

### Webshell Categories

| Category | Complexity | Example |
|----------|-----------|---------|
| One-liner | Minimal | `<?php system($_GET['c']); ?>` |
| Standard | Moderate | China Chopper, WSO, b374k |
| Encrypted | High | AES-encrypted payload with key exchange |
| Memory-only | Advanced | .NET ISAPI filter, Apache module |

### Obfuscation Techniques

- **String concatenation**: `$a='sys'; $b='tem'; $a.$b($_GET['c']);`
- **Base64 encoding**: `eval(base64_decode('...'))`
- **Variable functions**: `$f='system'; $f($cmd);`
- **Rot13/XOR**: `eval(str_rot13('...'))` or XOR-encoded payload
- **Callback abuse**: `array_map('system', $_GET);`

## Workflow

### Step 1: Detect Webshells on Filesystem

```bash
# YARA scan web directories
yara -r webshell_rules.yar /var/www/html/

# Find recently modified PHP/ASP/JSP files
find /var/www/ -name "*.php" -mtime -7 -exec ls -la {} \;
find /var/www/ -name "*.asp*" -mtime -7 -exec ls -la {} \;

# NeoPI entropy scanner — high entropy = obfuscated
python3 neopi.py -a /var/www/html/ -e php

# Search for common webshell patterns
grep -rn "eval\s*(" /var/www/html/ --include="*.php"
grep -rn "base64_decode\|gzinflate\|str_rot13" /var/www/html/ --include="*.php"
grep -rn "ProcessStartInfo\|cmd\.exe\|/bin/sh" /var/www/html/ --include="*.aspx"

# Find PHP files with suspicious function calls
grep -rlE "assert\(|preg_replace.*e[\"']|create_function|call_user_func" /var/www/html/ --include="*.php"
```

### Step 2: Deobfuscate Webshell Code

```bash
# PHP — replace eval with echo for safe deobfuscation
sed 's/eval(/echo(/g' webshell.php | php -r "$(cat)"

# Multi-layer base64 unwrap
python3 -c "
import base64
payload = open('webshell.php').read()
import re
matches = re.findall(r'base64_decode\([\"\\']([A-Za-z0-9+/=]+)[\"\\']', payload)
for m in matches:
    decoded = base64.b64decode(m).decode(errors='replace')
    print(f'--- Decoded Layer ---')
    print(decoded[:500])
"

# PHP deobfuscation with UnPHP
# https://www.unphp.net/ (for non-sensitive samples)
```

### Step 3: Analyze Webshell Capabilities

```bash
# Map functionality by function calls
python3 -c "
import re
code = open('deobfuscated_shell.php').read()
capabilities = {
    'command_exec': r'system|exec|passthru|shell_exec|popen|proc_open',
    'file_ops': r'fopen|file_put_contents|fwrite|copy|rename|unlink',
    'db_access': r'mysql_connect|mysqli|pg_connect|sqlite',
    'network': r'fsockopen|curl_exec|file_get_contents.*http',
    'info_gathering': r'phpinfo|get_current_user|getmyuid',
    'encoding': r'base64_encode|gzdeflate|urlencode',
}
for cap, pattern in capabilities.items():
    matches = re.findall(pattern, code)
    if matches:
        print(f'{cap}: {list(set(matches))}')
"
```

### Step 4: Correlate with Access Logs

```bash
# Find POST requests to webshell path
grep "POST /uploads/shell.php" /var/log/apache2/access.log

# Identify all requests from attacker IP
grep "192.168.1.100" /var/log/apache2/access.log | \
    awk '{print $7}' | sort | uniq -c | sort -rn

# Find suspicious user-agents
grep -iE "python-requests|curl|wget|powershell" /var/log/apache2/access.log
```

## YARA Rule

```yara
rule Webshell_PHP_Generic {
    meta:
        description = "Detects common PHP webshell patterns"
        author = "NERF"
        date = "2026-03-17"
        mitre_attack = "T1505.003"
        severity = "critical"
    strings:
        $eval = /eval\s*\(\s*\$_(GET|POST|REQUEST|COOKIE)/ ascii
        $system = /system\s*\(\s*\$_(GET|POST|REQUEST)/ ascii
        $b64 = "eval(base64_decode(" ascii
        $assert = /assert\s*\(\s*\$_(GET|POST|REQUEST)/ ascii
        $callback = /array_map\s*\(\s*['\"]system['\"]/ ascii
        $preg = /preg_replace\s*\(.*\/e['"]/ ascii
    condition:
        filesize < 500KB and
        any of them
}
```

## Detection

```yaml
title: Webshell Artifacts Detection
id: afe0fbd0-411b-456a-9b7e-576788259acc
status: experimental
description: Detects suspicious activity related to analyzing webshell artifacts techniques in malware analysis context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*analyzing*webshell*"
  condition: selection
level: high
tags:
  - attack.t1505.003
  - attack.execution
falsepositives:
  - Sandbox detonation environments analyzing submitted samples
```

## Verification

- [ ] Webshell detected and isolated from web root
- [ ] Obfuscation layers removed and code readable
- [ ] Capabilities mapped (exec, file ops, network, db)
- [ ] Authentication mechanism extracted (if present)
- [ ] Access logs correlated for attacker activity timeline
- [ ] YARA rule written and tested against clean file set
- [ ] IOCs extracted (attacker IPs, user-agents, timestamps)

## References

- [MITRE ATT&CK T1505.003 — Web Shell](https://attack.mitre.org/techniques/T1505/003/)
- [Neo23x0 YARA Webshell Rules](https://github.com/Neo23x0/signature-base)
- [NeoPI — Statistical Webshell Detector](https://github.com/Neohapsis/NeoPI)
- [CISA Alert — Web Shell Detection](https://www.cisa.gov/news-events/analysis-reports/ar21-013a)
