PHP Webshell Obfuscation Detection

This rule detects PHP webshells that utilize a specific obfuscation technique. It looks for PHP code that concatenates strings using apostrophes and dots, where each string segment is 1 to 3 alphanumeric characters long. This pattern is indicative of an attempt to hide malicious code within a PHP file.