IvantiSentry_PHP_System_Webshell

rule IvantiSentry_PHP_System_Webshell
{
    meta:
        description = "One-line PHP command webshell executing a GET parameter"
        reference = "CVE-2026-10520 Ivanti Sentry exploitation"
    strings:
        $a = "system($_GET[" ascii
        $b = "<?php" ascii
    condition:
        filesize < 2KB and all of them
}