/*
    Source: research.ohiiho.com/arsenal/ninja/
    Author: OHIIHO Research
    License: Free to use with attribution.
*/

rule webshell_ninja {
    meta:
        description = "Ninja webshell with embedded PHPMailer and tracking beacon (strong anchor: globe.moreforme.net)"
        author      = "OHIIHO Threat Research"
        reference   = "https://research.ohiiho.com/arsenal/ninja/"
        status      = "validated"

    strings:
        $phpmailer_class = "class PHPMailer" ascii
        $smtp_class      = "class SMTP" ascii
        $smtp_version    = "const VERSION='6.0.7'" ascii
        $from_root       = "$From='root@localhost'" ascii
        $fromname        = "$FromName='Root User'" ascii
        $sendmail_path   = "$Sendmail='/usr/sbin/sendmail'" ascii
        $tracking        = "globe.moreforme.net" ascii
        $password_123    = "$password = \"123\"" ascii

    condition:
        filesize < 150KB
        and $phpmailer_class
        and $smtp_class
        and (
            $tracking                                            // unique Ninja IOC
            or $from_root or $fromname or $password_123
            or $smtp_version or $sendmail_path
        )
}