This hunt targets the presence of known IOCs associated with the php.shin_webshell, indicating that an adversary has successfully deployed a PHP-based web shell to maintain persistent access or execute arbitrary commands on a web server. Proactively hunting for these indicators in Azure Sentinel is critical to identify compromised web applications before the attacker leverages the web shell for lateral movement, data exfiltration, or further payload delivery.
Malware Family: php.shin_webshell Total IOCs: 7 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | g9564ynbca.workers.dev | botnet_cc | 2026-09-04 | 50% |
| domain | lykelydy.workers.dev | botnet_cc | 2026-09-04 | 50% |
| domain | xkmspju76w.workers.dev | botnet_cc | 2026-09-04 | 50% |
| domain | vepixesu.workers.dev | botnet_cc | 2026-09-04 | 50% |
| domain | guqyvuqe.workers.dev | botnet_cc | 2026-09-04 | 50% |
| domain | 4iszv16b5d.workers.dev | botnet_cc | 2026-09-04 | 50% |
| domain | davulany.workers.dev | botnet_cc | 2026-09-04 | 50% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - php.shin_webshell
let malicious_domains = dynamic(["g9564ynbca.workers.dev", "lykelydy.workers.dev", "xkmspju76w.workers.dev", "vepixesu.workers.dev", "guqyvuqe.workers.dev", "4iszv16b5d.workers.dev", "davulany.workers.dev"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
Legacy Application Maintenance and Debugging: Developers or DevOps engineers may intentionally place lightweight PHP scripts (e.g., debug.php, test.php, or config_check.php) in web root directories to verify server configurations, test database connectivity, or debug deployment issues. These scripts often contain standard PHP functions that might overlap with the IOCs (such as base64_decode, eval, or specific file paths).
/dev/, /staging/, /debug/) or files with names explicitly ending in _debug.php or _test.php during non-production hours.Third-Party Plugin or Library Updates: When updating popular CMS plugins (e.g., WordPress, Joomla) or PHP libraries, the update process may temporarily write new PHP files to the web root. If the update package includes helper scripts or if the installer creates temporary files (e.g., update_helper.php, install_tmp.php) that match the IOC patterns, the rule may trigger.
tmp_, temp_, or update_.Scheduled Health Check or Monitoring Scripts: Enterprise monitoring tools (e.g., Nagios, Zabbix, custom Python/PHP health checkers) often deploy small PHP scripts to the web server to report status codes, check uptime, or validate SSL certificates. These scripts may use basic PHP functions that align with the IOCs.
health_check.php, status.php, monitor.php)