Hunting Web Shells with YARA, Entropy and File Analysis

A web shell can sit unused for months, which makes behavioural detection blind to it by design. Scheduled, scoped file analysis closes that gap: community YARA rules for known families, statistical heuristics for obfuscated files, and a baseline of what your web roots are supposed to contain. We recommend running all three, in that order of precision.

Signals at a Glance

Scheduled YARA Scans

Run YARA against web roots, upload directories and temporary compilation folders on a schedule, with a maintained rule set as the base. Supplement it with your own small rules that match what you have seen. This rule flags files that decode an input parameter and execute it, a pattern shared by many shells regardless of language:

rule HUNT_WebShell_Decode_And_Execute
{
    meta:
        description = "Request input decoded then executed (hunt, tune/validate)"
        scope = "web roots only"
    strings:
        $in1 = /\$_(POST|REQUEST|GET|COOKIE)\s*\[/ nocase
        $in2 = "Request.Form" nocase
        $in3 = "request.getParameter" nocase
        $dec1 = "base64_decode" nocase
        $dec2 = "FromBase64String" nocase
        $dec3 = "gzinflate" nocase
        $dec4 = "str_rot13" nocase
        $exe1 = /\b(eval|assert|system|passthru|shell_exec|popen|proc_open)\s*\(/ nocase
        $exe2 = "Runtime.getRuntime().exec" nocase
        $exe3 = "System.Diagnostics.Process" nocase
    condition:
        filesize < 500KB and
        (1 of ($in*)) and (1 of ($dec*)) and (1 of ($exe*))
}

Run it through yara -r (or your EDR’s file scan) and send matches, with file hashes, to your case queue. Exclude directories that hold only third-party libraries after reviewing them once.

Entropy, Structure and Provenance

Obfuscated shells defeat string rules, but they look unusual: long lines, few spaces and high entropy. A quick script ranks files so that an analyst reviews the strangest few first:

#!/usr/bin/env python3
# Rank script files under a web root by entropy and longest line (hunt aid, tune/validate)
import math, os, sys
from collections import Counter

EXT = {".php", ".phtml", ".jsp", ".jspx", ".aspx", ".ashx", ".asmx"}

def entropy(data: bytes) -> float:
    if not data:
        return 0.0
    counts = Counter(data)
    n = len(data)
    return -sum((c / n) * math.log2(c / n) for c in counts.values())

root = sys.argv[1]
rows = []
for base, _, files in os.walk(root):
    for name in files:
        if os.path.splitext(name)[1].lower() in EXT:
            path = os.path.join(base, name)
            try:
                data = open(path, "rb").read()
            except OSError:
                continue
            longest = max((len(l) for l in data.splitlines()), default=0)
            rows.append((entropy(data), longest, len(data), path))

for e, longest, size, path in sorted(rows, reverse=True)[:50]:
    print(f"{e:5.2f}  longest_line={longest:6d}  size={size:8d}  {path}")

• Combine scores: a small file with high entropy, one very long line and a recent creation time is far more suspicious than any one property.
• Hash every script in web roots after each release and store the manifest outside the server. Any file not in the manifest is a lead, and a mismatch on a known file is a stronger one.
• Compare owners and timestamps: files owned by the web server account and created outside a deployment window deserve review.
• When a file is suspicious, do not open it in a browser or run it. Copy it to an isolated analysis host, record hashes, and check access logs for who requested it and when.
• Feed every confirmed shell back into a local YARA rule, so the next instance is detected on the first scan.