ThreatFox: php.shin_webshell IOCs

Hunt Hypothesis

This rule detects the presence of known IOCs associated with the php.shin_webshell, indicating that an adversary has likely established a persistent foothold on a web server to execute arbitrary code or maintain access. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to identify and remediate compromised assets before the webshell is leveraged for lateral movement or data exfiltration.

IOC Summary

Malware Family: php.shin_webshell Total IOCs: 17 IOC Types: domain

Type	Value	Threat Type	First Seen	Confidence
domain	`rfei9fublu.workers.dev`	botnet_cc	2026-09-05	50%
domain	`rn6l1ksf4r.workers.dev`	botnet_cc	2026-09-05	50%
domain	`xegyvoca.workers.dev`	botnet_cc	2026-09-05	50%
domain	`qavenu.workers.dev`	botnet_cc	2026-09-05	50%
domain	`ah373ktvtb.workers.dev`	botnet_cc	2026-09-05	50%
domain	`gelekewo.workers.dev`	botnet_cc	2026-09-05	50%
domain	`xagaqoro.workers.dev`	botnet_cc	2026-09-05	50%
domain	`zynigoci.workers.dev`	botnet_cc	2026-09-05	50%
domain	`1hji53mps8.workers.dev`	botnet_cc	2026-09-05	50%
domain	`tijide.workers.dev`	botnet_cc	2026-09-05	50%
domain	`whitedierdre.workers.dev`	botnet_cc	2026-09-05	50%
domain	`agrou68423.workers.dev`	botnet_cc	2026-09-05	50%
domain	`poppyevolutionary.workers.dev`	botnet_cc	2026-09-04	50%
domain	`fdofw36596.workers.dev`	botnet_cc	2026-09-04	50%
domain	`diroqavu.workers.dev`	botnet_cc	2026-09-04	50%
domain	`garagope.workers.dev`	botnet_cc	2026-09-04	50%
domain	`weduge.workers.dev`	botnet_cc	2026-09-04	50%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - php.shin_webshell
let malicious_domains = dynamic(["rfei9fublu.workers.dev", "rn6l1ksf4r.workers.dev", "xegyvoca.workers.dev", "qavenu.workers.dev", "ah373ktvtb.workers.dev", "gelekewo.workers.dev", "xagaqoro.workers.dev", "zynigoci.workers.dev", "1hji53mps8.workers.dev", "tijide.workers.dev", "whitedierdre.workers.dev", "agrou68423.workers.dev", "poppyevolutionary.workers.dev", "fdofw36596.workers.dev", "diroqavu.workers.dev", "garagope.workers.dev", "weduge.workers.dev"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

Sentinel Table	Notes
`DnsEvents`	Ensure this data connector is enabled

References

ThreatFox — php.shin_webshell

False Positive Guidance

Legacy Application Maintenance Scripts: A web application (e.g., an older PHP-based CMS or internal tool) uses a custom maintenance script that includes a base64-encoded payload for obfuscation or specific string patterns matching the Shin Webshell IOCs (such as $_POST['shin'] or specific base64 strings).
- Filter/Exclusion: Exclude processes where the parent process is a known web server worker (e.g., php-fpm, apache2, nginx with PHP module) and the command line contains specific legacy script paths (e.g., /var/www/html/legacy/maintain.php).
CI/CD Pipeline Artifacts: A Continuous Integration/Deployment pipeline (e.g., Jenkins, GitLab CI) downloads or generates a temporary PHP test file or a dependency check script that inadvertently contains one of the 17 IOCs (e.g., a known base64 string used for checksum verification or a test vector).
- Filter/Exclusion: Exclude events where the file path resides within a CI/CD workspace directory (e.g., /var/lib/jenkins/workspace/, /home/gitlab-runner/builds/) and the process is associated with a build agent user.
Security Testing and Penetration Tests: An internal security team or external auditor runs a webshell detection tool or places a benign canary file containing Shin Webshell IOCs to verify that the detection rule is firing correctly.
- Filter/Exclusion: Exclude events where the source IP address is within the designated security team subnet (e.g., 10.20.30.0/24) or where the process name is a known security tool (e.g., wpscan, nikto, phpunit with specific test arguments).
Backup and Restore Operations: A backup utility (e.g.,