rule OffSeq_Updraft_Delivered_PHP_Webshell_20260906
{
    meta:
        description = "File triage for the small PHP webshell delivered in the Mirage UpdraftPlus cohort"
        author = "OffSeq Cybersecurity"
        date = "2026-09-06"
        reference = "https://offseq.com/en/research/the-backdoor-inside-the-backup-request/"
        sample_sha256 = "ac87d574d74c854d1be68274a7915cfa5a3a6750ca3e89cec2ea02301d66cabe"
        scope = "Recovered small payload only; not a general CVE detector or attribution rule"

    strings:
        $php = "<?php" ascii
        $marker = "postpass2" ascii
        $xor_key = "myXorSecret" ascii
        $gate = "admin888" ascii
        $upload_field = "b64data" ascii

    condition:
        filesize < 128KB and
        $php at 0 and
        $marker and $xor_key and
        1 of ($gate, $upload_field)
}