This hunt detects adversary activity involving the deployment of the php.shin_webshell backdoor, which attackers utilize to establish persistent access and execute arbitrary commands on compromised web servers. Proactively hunting for these specific IOCs in Azure Sentinel is critical because this webshell often serves as an initial foothold that enables lateral movement and data exfiltration before traditional perimeter defenses can react.
Malware Family: php.shin_webshell Total IOCs: 21 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | pumula.workers.dev | botnet_cc | 2026-08-26 | 50% |
| domain | pibutyva.workers.dev | botnet_cc | 2026-08-26 | 50% |
| domain | qiteryqy.workers.dev | botnet_cc | 2026-08-26 | 50% |
| domain | heleqoja.workers.dev | botnet_cc | 2026-08-26 | 50% |
| domain | qne77uxu27.workers.dev | botnet_cc | 2026-08-26 | 50% |
| domain | fkb7qoeakw.workers.dev | botnet_cc | 2026-08-26 | 50% |
| domain | monique97.workers.dev | botnet_cc | 2026-08-26 | 50% |
| domain | mybai64034.workers.dev | botnet_cc | 2026-08-26 | 50% |
| domain | nopofomo.workers.dev | botnet_cc | 2026-08-26 | 50% |
| domain | mojuti.workers.dev | botnet_cc | 2026-08-26 | 50% |
| domain | salmontabbie.workers.dev | botnet_cc | 2026-08-26 | 50% |
| domain | bimuweha.workers.dev | botnet_cc | 2026-08-26 | 50% |
| domain | lifimalo.workers.dev | botnet_cc | 2026-08-26 | 50% |
| domain | u3qr1x83a9.workers.dev | botnet_cc | 2026-08-26 | 50% |
| domain | sigekynu.workers.dev | botnet_cc | 2026-08-26 | 50% |
| domain | rihume.workers.dev | botnet_cc | 2026-08-26 | 50% |
| domain | rirezewo.workers.dev | botnet_cc | 2026-08-26 | 50% |
| domain | jecuju.workers.dev | botnet_cc | 2026-08-26 | 50% |
| domain | mobahewo.workers.dev | botnet_cc | 2026-08-26 | 50% |
| domain | 0h4947ym92.workers.dev | botnet_cc | 2026-08-26 | 50% |
| domain | muhodyru.workers.dev | botnet_cc | 2026-08-26 | 50% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - php.shin_webshell
let malicious_domains = dynamic(["pumula.workers.dev", "pibutyva.workers.dev", "qiteryqy.workers.dev", "heleqoja.workers.dev", "qne77uxu27.workers.dev", "fkb7qoeakw.workers.dev", "monique97.workers.dev", "mybai64034.workers.dev", "nopofomo.workers.dev", "mojuti.workers.dev", "salmontabbie.workers.dev", "bimuweha.workers.dev", "lifimalo.workers.dev", "u3qr1x83a9.workers.dev", "sigekynu.workers.dev", "rihume.workers.dev", "rirezewo.workers.dev", "jecuju.workers.dev", "mobahewo.workers.dev", "0h4947ym92.workers.dev", "muhodyru.workers.dev"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
Here are 4 specific false positive scenarios for the ThreatFox: php.shin_webshell detection rule, including targeted filters and exclusions suitable for an enterprise environment:
Scenario: Legitimate Web Application Deployment via CI/CD Pipelines
index.php files, configuration scripts, or maintenance mode pages that match the specific file hashes or content signatures of the Shin Webshell IOCs.jenkins-agent, gitlab-runner, or azure-pipelines AND the user account matches a known service identity (e.g., svc-deploy-web).Scenario: Scheduled Maintenance Scripts Running in Web Roots
/var/www/html or C:\inetpub\wwwroot) for log rotation, cache clearing, or database backups. These scripts may utilize standard PHP libraries that trigger the same IOCs as the malicious Shin Webshell.*/maintenance/*, */scripts/cron/*). Additionally, filter by Execution Time; if the file creation or modification timestamp aligns with the scheduled window of known jobs (e.g., 02:00–04:00 UTC daily), suppress the alert.Scenario: Third-Party CMS Plugin Updates