/*
    Source: research.ohiiho.com/arsenal/wso/
    Author: OHIIHO Research
    License: Free to use with attribution.
*/

rule webshell_w0rm_prepend {
    meta:
        description = "W0rm supply-chain prepend (cleartext or base64)"
        author      = "OHIIHO Threat Research"
        status      = "validated"

    strings:
        $w0rm_cmd   = "$_GET[\"cmd\"]" ascii
        $w0rm_xsec  = "$_GET[\"xsec\"]" ascii
        $w0rm_mail  = "md5.undersociety" ascii
        $w0rm_pb    = "pastebin.com/raw/" ascii
        $w0rm_block = "xsec=blocker" ascii
        $w0rm_log   = "errors_log" ascii
        $w0rm_b64pb = "aHR0cHM6Ly9wYXN0ZWJpbi5jb20vcmF3" ascii
        $w0rm_from  = "RnJvbTogVzBybQ" ascii

    condition:
        filesize < 500KB and 3 of them
}