/*
    Source: research.ohiiho.com/arsenal/indoxploit/
    Author: OHIIHO Research
    License: Free to use with attribution.
*/

rule webshell_indoxploit {
    meta:
        description = "IndoXploit webshell (Indonesian scene)"
        author      = "OHIIHO Threat Research"
        reference   = "https://research.ohiiho.com/arsenal/indoxploit/"
        status      = "validated"

    strings:
        $title         = "IndoXploit" ascii nocase
        $auth_pass     = "$auth_pass" ascii
        $default_hash  = "db315f48b0388b77d7f0fe45ec8d8e2f" ascii
        $zone_h        = "zone-h.com/notify/single" ascii
        $yougetsignal  = "yougetsignal.com/domains.php" ascii
        $ssl_verify    = "CURLOPT_SSL_VERIFYPEER" ascii
        $wp_upload     = "wp-admin/update.php?action=upload-theme" ascii
        $magic_quotes  = "set_magic_quotes_runtime" ascii

    condition:
        filesize < 150KB
        and $title
        and ($auth_pass or $default_hash)
        and ($zone_h or $yougetsignal or $wp_upload or $ssl_verify or $magic_quotes)
}