This hunt identifies the presence of the PHP Shin webshell, a high-severity backdoor that adversaries deploy to maintain persistent access and execute arbitrary commands on compromised web servers. Proactively hunting for these specific IOCs in Azure Sentinel allows the SOC to detect stealthy persistence mechanisms that may evade standard behavioral detections, enabling rapid containment before the webshell is leveraged for lateral movement or data exfiltration.
Malware Family: php.shin_webshell Total IOCs: 9 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | ldsbd94302.workers.dev | botnet_cc | 2026-09-06 | 50% |
| domain | tr5d4edcny.workers.dev | botnet_cc | 2026-09-06 | 50% |
| domain | marooneran.workers.dev | botnet_cc | 2026-09-06 | 50% |
| domain | xflzi12337.workers.dev | botnet_cc | 2026-09-06 | 50% |
| domain | jyrybi.workers.dev | botnet_cc | 2026-09-06 | 50% |
| domain | buxarizo.workers.dev | botnet_cc | 2026-09-06 | 50% |
| domain | 9cc0ohnr54.workers.dev | botnet_cc | 2026-09-06 | 50% |
| domain | slimyleilah.workers.dev | botnet_cc | 2026-09-06 | 50% |
| domain | qegepifu.workers.dev | botnet_cc | 2026-09-06 | 50% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - php.shin_webshell
let malicious_domains = dynamic(["ldsbd94302.workers.dev", "tr5d4edcny.workers.dev", "marooneran.workers.dev", "xflzi12337.workers.dev", "jyrybi.workers.dev", "buxarizo.workers.dev", "9cc0ohnr54.workers.dev", "slimyleilah.workers.dev", "qegepifu.workers.dev"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
shin.php file to a staging or production web server to test a specific PHP-based vulnerability or to run a one-off data migration script that relies on the Shin webshell’s functionality.
10.0.0.0/8 or 192.168.0.0/16 ranges and the destination port is 443 (HTTPS) rather than 80, or if the user account belongs to the devops-admins or web-team AD group.cron or Windows Task Scheduler) that restores a backup of a web application directory containing the shin.php file to a temporary staging folder before verifying integrity, where the file remains on disk briefly during the validation phase.
*/tmp/staging/ or */backup-restore/ and the process initiating the file creation is rsync, tar, or robocopy with a known service account (e.g., svc-backup).shin.php handler for webhook processing or session management, using the same filename convention as the known IOCs.
php-fpm, apache2, nginx) and the file is located in a specific application directory (e.g., /var/www/html/app/plugins/) rather than the root web directory.