Threat Definitions & Detection Levels

AMWScan ships its detection data through the Signatures API and includes a complete embedded bundle in every release. Application integrations should use the documented read-only methods in Signature Lookup, not the mutable definition arrays.

Embedded definitions include:

• Plain text fragments and 10,207 optimized regular expressions, including malware signatures
• Exact SHA-256 malware hashes generated from the repository fixture corpus.
• Fixed-width known-malware MD5-prefix candidates.
• Normalized legacy-core SHA-256 signatures used by the optional WordPress module.
• 54 suspicious domains curated from malware fixtures and excluded when found in clean fixtures or identified as legitimate shared services.
• Scoped JavaScript definitions for decoded dynamic execution, cookie-sourced execution, character-code script injection, XOR/Base64 payload execution, and long encoded document writes. These definitions run only on .js files.

AMWScan definition bundle

Official definition sources live in definitions/src/ and are built into the gzip-compressed TAR resources/definitions/definitions.amwdb fallback shipped with each package release. An AMWDB archive contains manifest.json, signatures.json, exploits.json, hashes.json, and functions.json. The function lists are editable definition data, not PHP source. The manifest records a monotonic sequence, engine compatibility, and the exact size and SHA-256 of every payload. The scanner validates archive contents, schema, regular expressions, sorted hash indexes, record counts, and checksums before using a bundle.

At startup, the scanner uses a valid cached AMWDB archive or the embedded fallback without requiring network access. It discovers official definitions-v* releases through the GitHub Releases API, downloads the release-owned definitions.json metadata asset, validates a changed archive in a private staging directory, and switches the active pointer only after every check passes. AMWSCAN_DEFINITIONS_METADATA_URL or --definitions-update-url=<https-url> can override discovery for a controlled mirror. Interrupted, incomplete, corrupt, or older downloads leave the last verified cache active.

Use --path-definitions=<path> to choose the private cache root. Add --disable-definitions-update to prevent network requests and use only a verified cached bundle or the embedded copy. Reports include the active AMWScan definition version, sequence, and manifest hash.

Use amwscan definitions status, amwscan definitions verify, and amwscan definitions inspect <database> to inspect active or downloaded archives. Maintainers use bin/amwscan-definitions validate and bin/amwscan-definitions build to validate source JSON and build the package fallback. Publisher signing is not enabled until a release signing key and stable official metadata endpoint are provisioned; status reports this explicitly as unsigned.

False-positive controls

Lite-only heuristic candidates

Lite retains matches from align, concat_vars_with_spaces, concat_vars_array, hex_char, silence_inclusion, php_uname, ioncube_loader, and source_guardian as informational exploit-candidate findings. These patterns identify structure, encoded names, paths, or nearby operations; they do not establish malicious data flow. The execution rule also reports decoded callback names as candidates unless executable request input appears in the matched callback argument or a direct Base64/ROT13 decode names a known dangerous function. Callback APIs do not interpret their argument as PHP or shell source.

Candidates carry confirmed: false, remain eligible for optional advisory AI review, and do not alone trigger remediation or a nonzero CLI exit code. Independent execution detections and specific signatures retain their severity. Full mode is unchanged. An informational candidate does not establish safety: custom decoding, array keys, and file-derived values still need review.

Lite additionally checks PHP token context for structural matches, request-driven file writes, reconnaissance/SourceGuardian calls, and sensitive-file reads. Its execution rule recognizes request-controlled backtick commands, including after another shell command, without treating quoted examples or escaped dollar signs as executable input. Raw corpus regex baselines do not include these contextual or severity decisions; scanner regression tests cover them.

Shared controls

Use --lite --report-only for an initial review. In Full, Lite, and signature-enabled modes, a bare generic keyword match such as backdoor produces an informational keyword finding, with confirmed: false, rather than a malware detection. These advisories do not trigger file remediation or a nonzero CLI exit code. Matches inside longer words do not produce keyword advisories. More specific signatures keep their existing severity.

Function checks preserve standalone encoded names such as lave as informational encoded-function-candidate findings, even in assignments, array keys, or text data. They do not mark a file infected, trigger remediation, or fail the CLI scan on their own. Substrings in ordinary words such as lavender do not qualify. An exact encoded name passed directly to strrev, str_rot13, or base64_decode remains a detection. The reversed-name exploit rule also requires strrev(...).

When enabled, AI review can assess keyword and encoded-name candidates for benign use or indirect decoding and execution. Verdicts remain advisory. Neither token checks nor a bounded AI excerpt can reliably resolve arbitrary custom decoding or values assembled from file offsets; an informational finding is not a declaration that the file is safe.

Function checks and execution-oriented exploit rules use PHP token context. They reject matches that start inside comments, string literals, HTML, longer identifiers, or unrelated method calls. This applies to eval/decoder execution, request-driven execution and callbacks, direct request extraction, and encoded inclusion rules. It does not disable text-based malware signatures, defacement markers, or non-PHP rules such as SSI and .htaccess checks. A complete malware sample embedded in documentation can still match a specific signature.

In Full and Lite scans, the base64_inclusion rule covers include statements that build Base64 data: or data:// URIs from $_GET, $_POST, or $_REQUEST, through concatenation or double-quoted interpolation. URI assignments, static Base64 text, and single-quoted strings containing literal variable names do not trigger this rule. Decoding preserves heredoc and nowdoc line breaks, keeping documentation strings distinct from executable PHP for context checks.

You can exclude a reviewed exploit with --ignore-exploits=<name> for one scan or use a local rule override for subsequent scans. Prefer whitelisting a reviewed finding when you still need the rule elsewhere.

Local administrator rules

Local rules are separate from the immutable official archive. By default they live under the platform configuration directory in amwscan/rules; use --path-local-rules=<path> to override that directory for a scan. Optional local signatures.json, exploits.json, and hashes.json files must use the same validated format as official rule payloads and are merged after the official database.

Use amwscan rules validate to validate local files. amwscan rules disable exploit:<name> records an administrator override in disabled.json and amwscan rules list shows those overrides. Local rules are never downloaded, modified, or repacked by definition updates.

Integrity manifests

Trusted manifests report missing, modified, and unexpected managed files. WordPress core integrity covers root core files, wp-admin, and wp-includes; it excludes user-managed wp-content, including optional bundled plugins and themes. On Windows, manifest paths are compared case-insensitively to match filesystem behavior.

The WordPress plugin offers a Restore trusted file action for missing files recorded by a trusted WordPress core manifest when ext-zip is available, including optional bundled files retained in historical reports. It downloads the matching official WordPress release, extracts only the selected file, verifies its trusted manifest checksum, and writes it inside the scanned WordPress root. Exceptions remain available for findings that are expected in the site's configuration.

Maltrail definitions

At scan startup, AMWScan downloads the current Maltrail malware-domain trails into its private operating-system cache and rebuilds the local index. The cache is outside the scanned project and never needs to be committed. Reports expose its record count, source hash, generated index hash, and update time.

Domain matches are warning-level indicators because previously malicious infrastructure can be remediated or reassigned. A truncated hash or historical domain reference is insufficient to confirm malware by itself.