ThreatFox: php.shin_webshell IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the deployment of a PHP web shell named shin_webshell, which attackers often use to establish persistent access and execute arbitrary commands on compromised web servers. The SOC team should proactively hunt for this indicator in Azure Sentinel because early identification of such web shells allows for rapid containment before adversaries can escalate privileges or pivot to other internal systems.

IOC Summary

Malware Family: php.shin_webshell Total IOCs: 2 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - php.shin_webshell
let malicious_domains = dynamic(["8vfkm0gusw.workers.dev", "kegytamo.workers.dev"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — php.shin_webshell

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: php.shin_webshell IOCs rule, tailored for an enterprise environment:

• Scheduled Backup of Web Content Directories

  • Scenario: Enterprise backup agents (e.g., Veeam or Commvault) regularly scan and archive web server directories (/var/www/html or C:\inetpub\wwwroot). If the backup process extracts a compressed archive containing known shin_webshell artifacts from previous legitimate deployments, the detection engine may flag these files as new IOCs.
  • Filter/Exclusion: Create an exclusion rule for processes identified as backup agents (e.g., vbr.exe, commvault_agent.exe) accessing web root directories during defined maintenance windows (e.g., 02:00–04:00 UTC).

• CI/CD Pipeline Deployment of Legacy Modules

  • Scenario: DevOps teams using tools like Jenkins or Azure DevOps deploy legacy PHP modules that include the shin_webshell library as a standard dependency. During automated builds, the deployment agent writes these files to the staging environment, triggering the IOC match before the application is fully validated in production.
  • Filter/Exclusion: Exclude file creation events originating from known CI/CD service accounts (e.g., svc-jenkins-deploy, azdo-build-agent) when they write to specific deployment folders (e.g., /deploy/staging).

• Automated Security Scanning and Remediation

  • Scenario: Internal vulnerability scanners (such as Qualys or Tenable) perform deep scans of web servers. When the scanner identifies a known benign instance of shin_webshell during a routine scan, it may temporarily move or hash the file to verify integrity, causing the detection rule to interpret this activity as a new threat event.