VOLEXITY_Susp_Php_Call_User_Func

rule VOLEXITY_Susp_Php_Call_User_Func : FILE
{
	meta:
		description = "Webshells using call_user_func() function against an object from a file input or POST variable."
		author = "threatintel@volexity.com"
		id = "48c7857e-7dda-5e3f-b82c-7d34c251f083"
		date = "2021-06-16"
		modified = "2024-07-30"
		reference = "https://zhuanlan.zhihu.com/p/354906657"
		source_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/2022/2022-06-15 DriftingCloud - Zero-Day Sophos Firewall Exploitation and an Insidious Breach/indicators/yara.yar#L183-L205"
		license_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/LICENSE.txt"
		hash = "40b053a2f3c8f47d252b960a9807b030b463ef793228b1670eda89f07b55b252"
		logic_hash = "46c999da97682023861e58f9cd2c8651480db990a0361c1985c6d5c35b5bf0ea"
		score = 65
		quality = 80
		tags = "FILE"
		os = "win,linux"
		os_arch = "all"
		scan_context = "file"
		severity = "high"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 5582
		version = 4

	strings:
		$s1 = "@call_user_func(new C()" wide ascii

	condition:
		$s1
}