/*
    Source: research.ohiiho.com/arsenal/wso/
    Author: OHIIHO Research
    License: Free to use with attribution.
*/

rule webshell_wso {
    meta:
        description = "WSO (Web Shell by Orb) v2.x"
        author      = "OHIIHO Threat Research"
        reference   = "https://research.ohiiho.com/arsenal/wso/"
        status      = "validated"

    strings:
        $auth_pass    = "$auth_pass" ascii
        $wso_cookie   = "WSOsetcookie" ascii
        $eval_p1      = "eval($_POST['p1'])" ascii
        $md5_host     = "md5($_SERVER['HTTP_HOST'])" ascii
        $globals_auth = "$GLOBALS['auth_pass']" ascii
        $post_pass    = "$_POST['pass']" ascii
        $filesman     = "FilesMan" ascii

    condition:
        filesize < 100KB
        and $auth_pass
        and ($wso_cookie or $md5_host or $globals_auth)
        and ($eval_p1 or $filesman or $post_pass)
}