/*
    Source: research.ohiiho.com/arsenal/m4r5-sh3ll/
    Author: OHIIHO Research
    License: Free to use with attribution.
*/

rule webshell_m4r5_sh3ll {
    meta:
        description = "m4r5-sh3ll webshell (bigsecc community)"
        author      = "OHIIHO Threat Research"
        reference   = "https://research.ohiiho.com/arsenal/m4r5-sh3ll/"
        status      = "validated"

    strings:
        $title      = "M4R5 SH3LL" ascii
        $subtitle   = "B1G53C C0MMUN17Y" ascii
        $themes     = "D4RK" ascii
        $bigsecc    = "bigsecc" ascii nocase
        $bigsec_in  = "bigsec.in" ascii
        $bigsec_tg  = "t.me/bigsecID" ascii
        $eval_b64   = "eval(base64_decode(" ascii
        $func_b64e  = "function B64E(" ascii
        $func_b64d  = "function B64D(" ascii

    condition:
        filesize < 200KB
        and ($title or $subtitle or $bigsecc or $bigsec_in or $bigsec_tg or $themes)
        and ($eval_b64 or $func_b64e or $func_b64d)
}