ThreatFox: php.shin_webshell IOCs

Hunt Hypothesis

This hypothesis targets the presence of the php.shin_webshell file, a known web shell used by adversaries to establish persistent remote code execution capabilities on compromised web servers. Proactively hunting for this specific indicator in Azure Sentinel allows the SOC team to identify stealthy backdoors that may have been deployed to maintain access and execute malicious payloads before they are leveraged for lateral movement or data exfiltration.

IOC Summary

Malware Family: php.shin_webshell Total IOCs: 2 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - php.shin_webshell
let malicious_domains = dynamic(["embarrassedyoshiko.workers.dev", "acrjb033vq.workers.dev"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — php.shin_webshell

False Positive Guidance

• Legitimate Web Application Deployment (CI/CD Pipeline)

  • Scenario: During a standard git pull or rsync deployment of a PHP-based web application (e.g., WordPress, Laravel, or custom internal tools), the build agent or deployment script writes new PHP files to the web root. If the deployment process involves a temporary staging directory or uses a generic filename that matches a known ThreatFox IOC (e.g., index.php in a non-standard location, or a specific hash match during a transient state), the rule may trigger.
  • Filter/Exclusion: Exclude events where the parent process is a known CI/CD agent (e.g., jenkins-agent, git, rsync, ansible) or where the file path resides within a designated deployment staging directory (e.g., /var/www/html/staging/) before it is moved to the final production path.

• Scheduled Cron Jobs for Log Rotation or Cleanup

  • Scenario: An enterprise cron job runs a PHP script (e.g., cleanup_logs.php) to rotate or delete old log files. If this script is located in a directory that overlaps with a ThreatFox IOC path (e.g., /tmp/ or /var/tmp/ if the IOC includes common temp directories) or if the script name coincidentally matches a known webshell filename (e.g., shell.php used for a specific internal utility), the detection may fire.
  • Filter/Exclusion: Exclude events where the parent process is cron or crond and the file path is within a known application-specific directory (e.g., /opt/app/scripts/) rather than a generic system temp directory. Alternatively, whitelist specific known PHP script hashes used by internal maintenance jobs.

• Development or Staging Environment Testing

  • Scenario: Developers in a staging