ThreatFox: php.shin_webshell IOCs

Hunt Hypothesis

This hypothesis targets the presence of the php.shin_webshell, a remote code execution tool used by adversaries to establish persistent access and exfiltrate data from compromised web servers. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify stealthy backdoors that may have bypassed initial perimeter defenses, ensuring rapid containment before the attacker leverages the webshell for lateral movement or data theft.

IOC Summary

Malware Family: php.shin_webshell Total IOCs: 6 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - php.shin_webshell
let malicious_domains = dynamic(["fajujyli.workers.dev", "xyhysa.workers.dev", "hhemb35077.workers.dev", "awv389zkti.workers.dev", "lefahe.workers.dev", "65ey0xwrct.workers.dev"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — php.shin_webshell

False Positive Guidance

• Scenario: Legacy PHP Frameworks with Unsanitized Input

  • Context: An enterprise e-commerce platform running an older version of a framework like Joomla or WordPress (prior to specific security patches) where a plugin uses include() or require() to load dynamic templates based on user-supplied parameters without strict whitelist validation.
  • Legitimate Action: A developer or admin uploads a custom theme file or configuration snippet via the CMS interface that contains standard PHP code patterns (e.g., <?php ... ?> with specific variable assignments) that match the heuristic signatures of the php.shin_webshell IOCs (such as specific base64-encoded strings or common function calls like base64_decode, str_rot13, or eval).
  • Filter/Exclusion: Exclude alerts where the file path resides in known CMS plugin/theme directories (e.g., /wp-content/plugins/, /wp-content/themes/, /components/) AND the file was modified by a service account associated with the CMS deployment pipeline (e.g., jenkins-cms-deploy or ansible-web-service).

• Scenario: Scheduled Log Rotation and Cleanup Scripts

  • Context: A Linux-based web server running Cron jobs to rotate and compress access logs (/var/log/apache2/ or /var/log/nginx/) using a custom PHP script for integration with a SIEM or data lake.
  • Legitimate Action: The script uses shell_exec() or exec() to run tar or gzip commands and includes standard PHP header/footer logic. If the script is stored in a non-standard location (e.g., /tmp/ or /var/www/html/maintenance/) and contains common obfuscation patterns used in legitimate logging tools (e.g., chr() concatenation for string building