This hunt targets the presence of known PHP Shin webshell indicators, which adversaries deploy to establish persistent, stealthy access for command execution and lateral movement. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify compromised web servers before attackers leverage the backdoor for deeper network infiltration or data exfiltration.
Malware Family: php.shin_webshell Total IOCs: 6 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | mwqhf37093.workers.dev | botnet_cc | 2026-09-03 | 50% |
| domain | gowinu.workers.dev | botnet_cc | 2026-09-03 | 50% |
| domain | tosulepa.workers.dev | botnet_cc | 2026-09-03 | 50% |
| domain | lzphy97221.workers.dev | botnet_cc | 2026-09-03 | 50% |
| domain | bqumy43555.workers.dev | botnet_cc | 2026-09-03 | 50% |
| domain | nodupoqi.workers.dev | botnet_cc | 2026-09-03 | 50% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - php.shin_webshell
let malicious_domains = dynamic(["mwqhf37093.workers.dev", "gowinu.workers.dev", "tosulepa.workers.dev", "lzphy97221.workers.dev", "bqumy43555.workers.dev", "nodupoqi.workers.dev"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
Legacy Application Maintenance: A developer or DevOps engineer is updating a legacy PHP application (e.g., an older version of WordPress, Joomla, or a custom internal tool) and temporarily introduces a known debug or maintenance script that matches one of the php.shin_webshell IOCs (such as specific file names like index.php with unusual content hashes or specific base64-encoded strings) for testing purposes.
10.20.0.0/24) and the user account belongs to the dev-team or app-ops group, provided the file path is under /var/www/html/legacy-app/ or similar known legacy directories.Automated Backup or Sync Jobs: A scheduled cron job or a tool like rsync or Unison is syncing a backup of a web server directory to a secondary storage location or staging environment. If the backup includes a previously infected or test file that matches the IOCs, the sync process may trigger the detection if the file is being written or read by a service account.
rsync, unison, or backup-agent, and the user account is a dedicated service account (e.g., svc-backup), especially if the destination path is a known backup share (e.g., \\fileserver\backups\).Staging Environment Testing: QA engineers are deploying a test build of a web application to a staging server to verify security patches. They may intentionally place a known vulnerable or test file (matching the IOCs) to validate that the detection rule works before promoting the build to production.